| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -quota.miloapis.com/v1alpha1 | -true | -
| kind | -string | -AllowanceBucket | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- AllowanceBucketSpec defines the desired state of AllowanceBucket.
-The system automatically creates buckets for each unique (consumer, resourceType) combination
-found in active ResourceGrants. - |
- true | -
| status | -object | -
- AllowanceBucketStatus contains the quota system-computed quota aggregation for a specific
-(consumer, resourceType) combination. The quota system continuously updates this status
-by aggregating capacity from active ResourceGrants and consumption from granted ResourceClaims. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| consumerRef | -object | -
- ConsumerRef identifies the quota consumer tracked by this bucket.
-Must match the ConsumerRef from ResourceGrants that contribute to this bucket.
-Only one bucket exists per unique (ConsumerRef, ResourceType) combination.
-
-Examples:
-- Organization "acme-corp" consuming Project quota
-- Project "web-app" consuming User quota
-- Organization "enterprise-corp" consuming storage quota - |
- true | -
| resourceType | -string | -
- ResourceType specifies which resource type this bucket aggregates quota for.
-Must exactly match a ResourceRegistration.spec.resourceType that is currently active.
-The quota system validates this reference and only creates buckets for registered types.
-
-The identifier format is flexible, as defined by platform administrators
-in their ResourceRegistrations.
-
-Examples:
-- "resourcemanager.miloapis.com/projects"
-- "compute_cpu"
-- "storage.volumes"
-- "custom-service-quota" - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -string | -
- Kind specifies the type of consumer resource.
-Must match an existing Kubernetes resource type that can receive quota grants.
-
-Common consumer types:
-- "Organization" (top-level quota consumer)
-- "Project" (project-level quota consumer)
-- "User" (user-level quota consumer) - |
- true | -
| name | -string | -
- Name identifies the specific consumer resource instance.
-Must match the name of an existing consumer resource in the cluster.
-
-Examples:
-- "acme-corp" (Organization name)
-- "web-application" (Project name)
-- "john.doe" (User name) - |
- true | -
| apiGroup | -string | -
- APIGroup specifies the API group of the consumer resource.
-Use full group name for Milo resources.
-
-Examples:
-- "resourcemanager.miloapis.com" (Organization/Project resources)
-- "iam.miloapis.com" (User/Group resources)
-- "infrastructure.miloapis.com" (infrastructure resources) - |
- false | -
| namespace | -string | -
- Namespace identifies the namespace of the consumer resource.
-Required for namespaced consumer resources (e.g., Projects).
-Leave empty for cluster-scoped consumer resources (e.g., Organizations).
-
-Examples:
-- "" (empty for cluster-scoped Organizations)
-- "organization-acme-corp" (namespace for Projects within an organization)
-- "project-web-app" (namespace for resources within a project) - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| allocated | -integer | -
- Allocated represents the total quota currently consumed by granted ResourceClaims.
-Calculated by summing all allocation amounts from ResourceClaims with status.conditions[type=Granted]=True
-that match the bucket's spec.consumerRef and have requests for spec.resourceType.
-
-Aggregation logic:
-- Only ResourceClaims with Granted=True contribute to allocated amount
-- Only requests matching spec.resourceType are included
-- All allocated amounts from matching requests are summed - - Format: int64 - Minimum: 0 - |
- true | -
| available | -integer | -
- Available represents the quota capacity remaining for new ResourceClaims.
-Always calculated as: Available = Limit - Allocated (never negative).
-The system uses this value to determine whether new ResourceClaims can be granted.
-
-Decision logic:
-- ResourceClaim is granted if requested amount <= Available
-- ResourceClaim is denied if requested amount > Available
-- Multiple concurrent claims may race; first to be processed wins - - Format: int64 - Minimum: 0 - |
- true | -
| claimCount | -integer | -
- ClaimCount indicates the total number of granted ResourceClaims consuming quota from this bucket.
-Includes all ResourceClaims with status.conditions[type=Granted]=True that have requests
-matching spec.resourceType and spec.consumerRef.
-
-Used for monitoring quota usage patterns and identifying potential issues. - - Format: int32 - Minimum: 0 - |
- true | -
| grantCount | -integer | -
- GrantCount indicates the total number of active ResourceGrants contributing to this bucket's limit.
-Includes all ResourceGrants with status.conditions[type=Active]=True that have allowances
-matching spec.resourceType and spec.consumerRef.
-
-Used for understanding quota source distribution and debugging capacity issues. - - Format: int32 - Minimum: 0 - |
- true | -
| limit | -integer | -
- Limit represents the total quota capacity available for this (consumer, resourceType) combination.
-Calculated by summing all bucket amounts from active ResourceGrants that match the bucket's
-spec.consumerRef and spec.resourceType. Measured in BaseUnit from the ResourceRegistration.
-
-Aggregation logic:
-- Only ResourceGrants with status.conditions[type=Active]=True contribute to the limit
-- All allowances matching spec.resourceType are included from contributing grants
-- All bucket amounts within matching allowances are summed - - Format: int64 - Minimum: 0 - |
- true | -
| contributingGrantRefs | -[]object | -
- ContributingGrantRefs provides detailed information about each ResourceGrant that contributes
-to this bucket's limit. Includes grant names, amounts, and last observed generations for
-tracking and debugging quota sources.
-
-This field provides visibility into:
-- Which grants are providing quota capacity
-- How much each grant contributes
-- Whether grants have been updated since last bucket calculation
-
-Grants are tracked individually because they are typically few in number compared to claims. - |
- false | -
| lastReconciliation | -string | -
- LastReconciliation records when the quota system last recalculated this status.
-Used for monitoring quota system health and understanding how fresh the aggregated data is.
-
-The quota system updates this timestamp every time it processes the bucket, regardless of
-whether the aggregated values changed. - - Format: date-time - |
- false | -
| observedGeneration | -integer | -
- ObservedGeneration indicates the most recent spec generation the quota system has processed.
-When ObservedGeneration matches metadata.generation, the status reflects the current spec.
-When ObservedGeneration is lower, the quota system is still processing recent changes. - - Format: int64 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| amount | -integer | -
- Amount specifies how much quota capacity this grant contributes to the bucket.
-Represents the sum of all buckets within all allowances for the matching
-resource type in the referenced grant. Measured in BaseUnit. - - Format: int64 - Minimum: 0 - |
- true | -
| lastObservedGeneration | -integer | -
- LastObservedGeneration records the ResourceGrant's generation when the bucket
-quota system last processed it. Used to detect when grants have been updated
-and the bucket needs to recalculate its aggregated limit. - - Format: int64 - |
- true | -
| name | -string | -
- Name identifies the ResourceGrant that contributes to this bucket's limit.
-Used for tracking quota sources and debugging allocation issues. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -quota.miloapis.com/v1alpha1 | -true | -
| kind | -string | -ClaimCreationPolicy | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- ClaimCreationPolicySpec defines the desired state of ClaimCreationPolicy. - |
- true | -
| status | -object | -
- ClaimCreationPolicyStatus defines the observed state of ClaimCreationPolicy.
-
-Status fields
-- conditions[type=Ready]: True when the policy is validated and active.
-
-See also
-- [ResourceClaim](#resourceclaim): The object created by this policy. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| target | -object | -
- Target defines how and where **ResourceClaims** should be created. - |
- true | -
| trigger | -object | -
- Trigger defines what resource changes should trigger claim creation. - |
- true | -
| disabled | -boolean | -
- Disabled determines if this policy is inactive.
-If true, no **ResourceClaims** will be created for matching resources. - - Default: false - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| resourceClaimTemplate | -object | -
- ResourceClaimTemplate defines how to create **ResourceClaims**.
-String fields support CEL expressions for dynamic content. - - Validations: |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| metadata | -object | -
- Metadata for the created **ResourceClaim**.
-String fields support CEL expressions. - |
- true | -
| spec | -object | -
- Spec for the created ResourceClaim.
-String fields support CEL expressions. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| annotations | -map[string]string | -
- Annotations specifies annotations to apply to the created ResourceClaim.
-Values support CEL expressions wrapped in {{ }} delimiters for dynamic content.
-The system automatically adds standard annotations for tracking.
-
-Template variables available:
-- trigger: The resource triggering claim creation
-- requestInfo: Request details
-- user: User information
-
-Examples:
-- created-for: "{{trigger.metadata.name}}" (CEL expression)
-- requested-by: "{{user.name}}" (CEL expression)
-- environment: "production" (literal string) - |
- false | -
| generateName | -string | -
- GenerateName specifies a prefix for auto-generated names when Name is empty.
-Kubernetes appends random characters to create unique names.
-Supports CEL expressions wrapped in {{ }} delimiters.
-
-Examples:
-- "{{trigger.spec.type + '-claim-'}}" (CEL expression)
-- "{{trigger.spec.type}}-claim-" (CEL + literal)
-- "quota-claim-" (literal string) - |
- false | -
| labels | -map[string]string | -
- Labels specifies static labels to apply to the created ResourceClaim.
-Values are literal strings (no template processing).
-The system automatically adds standard labels for policy tracking.
-
-Useful for:
-- Organizing claims by policy or resource type
-- Adding environment or tier indicators
-- Enabling label-based queries and monitoring - |
- false | -
| name | -string | -
- Name specifies the exact name for the created ResourceClaim.
-Supports CEL expressions wrapped in {{ }} delimiters with access to template variables.
-Leave empty to use GenerateName for auto-generated names.
-
-CEL Expression Syntax: CEL expressions must be enclosed in double curly braces {{ }}.
-Plain strings without {{ }} are treated as literal values.
-
-Template variables available:
-- trigger: The resource triggering claim creation
-- requestInfo: Request details (verb, resource, name, etc.)
-- user: User information (name, uid, groups, extra)
-
-Examples:
-- "{{trigger.metadata.name + '-quota-claim'}}" (CEL expression)
-- "{{trigger.metadata.name}}-claim" (CEL + literal)
-- "fixed-claim-name" (literal string) - |
- false | -
| namespace | -string | -
- Namespace specifies where the ResourceClaim will be created.
-Supports CEL expressions wrapped in {{ }} delimiters to derive namespace from trigger resource.
-Leave empty to create in the same namespace as the trigger resource.
-
-Examples:
-- "{{trigger.metadata.namespace}}" (CEL: same namespace as trigger)
-- "milo-system" (literal: fixed system namespace)
-- "{{trigger.spec.organization + '-claims'}}" (CEL: derived namespace) - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| requests | -[]object | -
- Requests specifies the resource types and amounts being claimed from quota.
-Each resource type can appear only once in the requests array. Minimum 1
-request, maximum 20 requests per claim.
-
-The system processes all requests as a single atomic operation: either all
-requests are granted or all are denied. - |
- true | -
| consumerRef | -object | -
- ConsumerRef identifies the quota consumer making this claim. The consumer
-must match the ConsumerType defined in the ResourceRegistration for each
-requested resource type. The system validates this relationship during
-claim processing.
-
-When creating ResourceClaims via ClaimCreationPolicy, this field can be
-omitted and the admission plugin will automatically fill it based on the
-authenticated user's context (organization or project).
-
-Examples:
-
- - Organization consuming Project quota
- - Project consuming User quota
- - Organization consuming storage quota - |
- false | -
| resourceRef | -object | -
- ResourceRef identifies the actual Kubernetes resource that triggered this
-claim. ClaimCreationPolicy automatically populates this field during
-admission. Uses unversioned reference (apiGroup + kind + name + namespace)
-to remain valid across API version changes.
-
-The referenced resource's kind must be listed in the ResourceRegistration's
-spec.claimingResources for the claim to be valid.
-
-Examples:
-
- - Project resource triggering Project quota claim
- - User resource triggering User quota claim
- - Organization resource triggering storage quota claim - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| amount | -integer | -
- Amount specifies how much quota to claim for this resource type. Must be
-measured in the BaseUnit defined by the corresponding ResourceRegistration.
-Must be a positive integer (minimum value is 0, but 0 means no quota
-requested).
-
-For Entity registrations: Use 1 for single resource instances (1 Project, 1
-User) For Allocation registrations: Use actual capacity amounts (2048 for
-2048 MB, 1000 for 1000 millicores)
-
-Examples:
-
- - 1 (claiming 1 Project)
- - 2048 (claiming 2048 bytes of storage)
- - 1000 (claiming 1000 CPU millicores) - - Format: int64 - Minimum: 0 - |
- true | -
| resourceType | -string | -
- ResourceType identifies the specific resource type being claimed. Must
-exactly match a ResourceRegistration.spec.resourceType that is currently
-active. The quota system validates this reference during claim processing.
-
-The format is defined by platform administrators when creating ResourceRegistrations.
-Service providers can use any identifier that makes sense for their quota system usage.
-
-Examples:
-
- - "resourcemanager.miloapis.com/projects"
- - "compute_cpu"
- - "storage.volumes"
- - "custom-service-quota" - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -string | -
- Kind specifies the type of consumer resource.
-Must match an existing Kubernetes resource type that can receive quota grants.
-
-Common consumer types:
-- "Organization" (top-level quota consumer)
-- "Project" (project-level quota consumer)
-- "User" (user-level quota consumer) - |
- true | -
| name | -string | -
- Name identifies the specific consumer resource instance.
-Must match the name of an existing consumer resource in the cluster.
-
-Examples:
-- "acme-corp" (Organization name)
-- "web-application" (Project name)
-- "john.doe" (User name) - |
- true | -
| apiGroup | -string | -
- APIGroup specifies the API group of the consumer resource.
-Use full group name for Milo resources.
-
-Examples:
-- "resourcemanager.miloapis.com" (Organization/Project resources)
-- "iam.miloapis.com" (User/Group resources)
-- "infrastructure.miloapis.com" (infrastructure resources) - |
- false | -
| namespace | -string | -
- Namespace identifies the namespace of the consumer resource.
-Required for namespaced consumer resources (e.g., Projects).
-Leave empty for cluster-scoped consumer resources (e.g., Organizations).
-
-Examples:
-- "" (empty for cluster-scoped Organizations)
-- "organization-acme-corp" (namespace for Projects within an organization)
-- "project-web-app" (namespace for resources within a project) - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -string | -
- Kind specifies the type of the referenced resource.
-Must match an existing Kubernetes resource type.
-
-Examples:
-- "Project" (Project resource that triggered quota claim)
-- "User" (User resource that triggered quota claim)
-- "Organization" (Organization resource that triggered quota claim) - |
- true | -
| name | -string | -
- Name identifies the specific resource instance that triggered the quota claim.
-Used for linking claims back to their triggering resources.
-
-Examples:
-- "web-app-project" (Project that triggered Project quota claim)
-- "john.doe" (User that triggered User quota claim) - |
- true | -
| apiGroup | -string | -
- APIGroup specifies the API group of the referenced resource.
-Use full group name for Milo resources.
-
-Examples:
-- "resourcemanager.miloapis.com" (Project, Organization)
-- "iam.miloapis.com" (User, Group)
-- "infrastructure.miloapis.com" (infrastructure resources) - |
- false | -
| namespace | -string | -
- Namespace specifies the namespace containing the referenced resource.
-Required for namespaced resources, omitted for cluster-scoped resources.
-
-Examples:
-- "acme-corp" (organization namespace containing Project)
-- "team-alpha" (project namespace containing User)
-- "" or omitted (for cluster-scoped resources like Organization) - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| resource | -object | -
- Resource specifies which resource type triggers this policy. - |
- true | -
| constraints | -[]object | -
- Constraints are CEL expressions that must evaluate to true for claim creation to occur.
-These are pure CEL expressions WITHOUT {{ }} delimiters (unlike template fields).
-Evaluated in the admission context. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -
- APIVersion of the trigger resource in the format "group/version" or "version" for core resources.
-Examples: "v1" for core resources like Secret, "resourcemanager.miloapis.com/v1alpha1" for custom resources. - |
- true | -
| kind | -string | -
- Kind is the kind of the trigger resource. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| expression | -string | -
- Expression specifies the CEL expression to evaluate against the trigger resource.
-This is a pure CEL expression WITHOUT {{ }} delimiters (unlike template fields).
-Must return a boolean value (true to match, false to skip).
-Maximum 1024 characters.
-
-Available variables in GrantCreationPolicy context:
-- trigger: The complete resource being watched (map[string]any)
- - trigger.metadata.name, trigger.spec.*, trigger.status.*, etc.
-
-Common expression patterns:
-- trigger.spec.tier == "premium" (check resource field)
-- trigger.metadata.labels["environment"] == "prod" (check labels)
-- trigger.status.phase == "Active" (check status)
-- trigger.metadata.namespace == "production" (check namespace)
-- has(trigger.spec.quotaProfile) (check field existence) - |
- true | -
| message | -string | -
- Message provides a human-readable description explaining when this condition applies.
-Used for documentation and debugging. Maximum 256 characters.
-
-Examples:
-- "Applies only to premium tier organizations"
-- "Matches organizations in production environment"
-- "Triggers when quota profile is specified" - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions represent the latest available observations of the policy's current state. - |
- false | -
| observedGeneration | -integer | -
- ObservedGeneration is the most recent generation observed. - - Format: int64 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -quota.miloapis.com/v1alpha1 | -true | -
| kind | -string | -GrantCreationPolicy | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- GrantCreationPolicySpec defines the desired state of GrantCreationPolicy. - |
- true | -
| status | -object | -
- GrantCreationPolicyStatus defines the observed state of GrantCreationPolicy.
-
-Status fields
-- conditions[type=Ready]: True when the policy is validated and active.
-- conditions[type=ParentContextReady]: True when cross‑cluster targeting is resolvable.
-- observedGeneration: Latest spec generation processed by the quota system.
-
-See also
-- [ResourceGrant](#resourcegrant): The object created by this policy.
-- [ResourceRegistration](#resourceregistration): Resource types for which grants are issued. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| target | -object | -
- Target defines where and how grants should be created. - |
- true | -
| trigger | -object | -
- Trigger defines what resource changes should trigger grant creation. - |
- true | -
| disabled | -boolean | -
- Disabled determines if this policy is inactive.
-If true, no **ResourceGrants** will be created for matching resources. - - Default: false - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| resourceGrantTemplate | -object | -
- ResourceGrantTemplate defines how to create **ResourceGrants**.
-String fields support CEL expressions wrapped in {{ }} delimiters for dynamic content.
-Plain strings without {{ }} are treated as literal values. - |
- true | -
| parentContext | -object | -
- ParentContext defines cross-control-plane targeting.
-If specified, grants will be created in the target parent context
-instead of the current control plane. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| metadata | -object | -
- Metadata for the created ResourceGrant.
-String fields support CEL expressions wrapped in {{ }} delimiters. - |
- true | -
| spec | -object | -
- Spec for the created ResourceGrant.
-String fields support CEL expressions wrapped in {{ }} delimiters. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| annotations | -map[string]string | -
- Annotations specifies annotations to apply to the created ResourceClaim.
-Values support CEL expressions wrapped in {{ }} delimiters for dynamic content.
-The system automatically adds standard annotations for tracking.
-
-Template variables available:
-- trigger: The resource triggering claim creation
-- requestInfo: Request details
-- user: User information
-
-Examples:
-- created-for: "{{trigger.metadata.name}}" (CEL expression)
-- requested-by: "{{user.name}}" (CEL expression)
-- environment: "production" (literal string) - |
- false | -
| generateName | -string | -
- GenerateName specifies a prefix for auto-generated names when Name is empty.
-Kubernetes appends random characters to create unique names.
-Supports CEL expressions wrapped in {{ }} delimiters.
-
-Examples:
-- "{{trigger.spec.type + '-claim-'}}" (CEL expression)
-- "{{trigger.spec.type}}-claim-" (CEL + literal)
-- "quota-claim-" (literal string) - |
- false | -
| labels | -map[string]string | -
- Labels specifies static labels to apply to the created ResourceClaim.
-Values are literal strings (no template processing).
-The system automatically adds standard labels for policy tracking.
-
-Useful for:
-- Organizing claims by policy or resource type
-- Adding environment or tier indicators
-- Enabling label-based queries and monitoring - |
- false | -
| name | -string | -
- Name specifies the exact name for the created ResourceClaim.
-Supports CEL expressions wrapped in {{ }} delimiters with access to template variables.
-Leave empty to use GenerateName for auto-generated names.
-
-CEL Expression Syntax: CEL expressions must be enclosed in double curly braces {{ }}.
-Plain strings without {{ }} are treated as literal values.
-
-Template variables available:
-- trigger: The resource triggering claim creation
-- requestInfo: Request details (verb, resource, name, etc.)
-- user: User information (name, uid, groups, extra)
-
-Examples:
-- "{{trigger.metadata.name + '-quota-claim'}}" (CEL expression)
-- "{{trigger.metadata.name}}-claim" (CEL + literal)
-- "fixed-claim-name" (literal string) - |
- false | -
| namespace | -string | -
- Namespace specifies where the ResourceClaim will be created.
-Supports CEL expressions wrapped in {{ }} delimiters to derive namespace from trigger resource.
-Leave empty to create in the same namespace as the trigger resource.
-
-Examples:
-- "{{trigger.metadata.namespace}}" (CEL: same namespace as trigger)
-- "milo-system" (literal: fixed system namespace)
-- "{{trigger.spec.organization + '-claims'}}" (CEL: derived namespace) - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| allowances | -[]object | -
- Allowances specifies the quota allocations provided by this grant.
-Each allowance grants capacity for a specific resource type.
-Minimum 1 allowance required, maximum 20 allowances per grant.
-
-All allowances in a single grant:
-- Apply to the same consumer (spec.consumerRef)
-- Contribute to the same AllowanceBucket for each resource type
-- Activate and deactivate together based on the grant's status - |
- true | -
| consumerRef | -object | -
- ConsumerRef identifies the quota consumer that receives these allowances.
-The consumer type must match the ConsumerType defined in the ResourceRegistration
-for each allowance resource type. The system validates this relationship.
-
-Examples:
-- Organization receiving Project quota allowances
-- Project receiving User quota allowances
-- Organization receiving storage quota allowances - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| buckets | -[]object | -
- Buckets contains the quota allocations for this resource type.
-All bucket amounts are summed to determine the total allowance.
-Minimum 1 bucket required per allowance.
-
-Multiple buckets can be used for:
-- Separating quota from different sources or tiers
-- Managing incremental quota increases over time
-- Tracking quota attribution for billing or reporting - |
- true | -
| resourceType | -string | -
- ResourceType identifies the specific resource type receiving quota allocation.
-Must exactly match a ResourceRegistration.spec.resourceType that is currently active.
-The quota system validates this reference when processing the grant.
-
-The identifier format is flexible, as defined by platform administrators
-in their ResourceRegistrations.
-
-Examples:
-- "resourcemanager.miloapis.com/projects"
-- "compute_cpu"
-- "storage.volumes"
-- "custom-service-quota" - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| amount | -integer | -
- Amount specifies the quota capacity provided by this bucket.
-Must be measured in the BaseUnit defined by the corresponding ResourceRegistration.
-Must be a non-negative integer (0 is valid but provides no quota).
-
-Examples:
-- 100 (providing 100 projects)
-- 2048000 (providing 2048000 bytes = 2GB)
-- 5000 (providing 5000 CPU millicores = 5 cores) - - Format: int64 - Minimum: 0 - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -string | -
- Kind specifies the type of consumer resource.
-Must match an existing Kubernetes resource type that can receive quota grants.
-
-Common consumer types:
-- "Organization" (top-level quota consumer)
-- "Project" (project-level quota consumer)
-- "User" (user-level quota consumer) - |
- true | -
| name | -string | -
- Name identifies the specific consumer resource instance.
-Must match the name of an existing consumer resource in the cluster.
-
-Examples:
-- "acme-corp" (Organization name)
-- "web-application" (Project name)
-- "john.doe" (User name) - |
- true | -
| apiGroup | -string | -
- APIGroup specifies the API group of the consumer resource.
-Use full group name for Milo resources.
-
-Examples:
-- "resourcemanager.miloapis.com" (Organization/Project resources)
-- "iam.miloapis.com" (User/Group resources)
-- "infrastructure.miloapis.com" (infrastructure resources) - |
- false | -
| namespace | -string | -
- Namespace identifies the namespace of the consumer resource.
-Required for namespaced consumer resources (e.g., Projects).
-Leave empty for cluster-scoped consumer resources (e.g., Organizations).
-
-Examples:
-- "" (empty for cluster-scoped Organizations)
-- "organization-acme-corp" (namespace for Projects within an organization)
-- "project-web-app" (namespace for resources within a project) - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiGroup | -string | -
- APIGroup specifies the API group of the parent context resource.
-Must follow DNS subdomain format. Maximum 253 characters.
-
-Examples:
-- "resourcemanager.miloapis.com" (for Organization parent context)
-- "infrastructure.miloapis.com" (for Cluster parent context) - |
- true | -
| kind | -string | -
- Kind specifies the resource type that represents the parent context.
-Must be a valid Kubernetes resource Kind. Maximum 63 characters.
-
-Examples:
-- "Organization" (create grants in organization's parent control plane)
-- "Cluster" (create grants in cluster's parent infrastructure) - |
- true | -
| nameExpression | -string | -
- NameExpression is a CEL expression that resolves the name of the parent context resource.
-Must return a string value that identifies the specific parent context instance.
-Maximum 512 characters.
-
-Available variables:
-- object: The trigger resource being evaluated (complete object)
-
-Common expression patterns:
-- object.spec.organization (direct field reference)
-- object.metadata.labels["parent-org"] (label-based resolution)
-- object.metadata.namespace.split("-")[0] (derived from namespace naming)
-
-Examples:
-- "acme-corp" (literal parent name)
-- object.spec.parentOrganization (field from trigger resource)
-- object.metadata.labels["quota.miloapis.com/organization"] (label value) - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| resource | -object | -
- Resource specifies which resource type triggers this policy. - |
- true | -
| constraints | -[]object | -
- Constraints are CEL expressions that must evaluate to true for grant creation.
-These are pure CEL expressions WITHOUT {{ }} delimiters (unlike template fields).
-All constraints must pass for the policy to trigger.
-The 'object' variable contains the trigger resource being evaluated. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -
- APIVersion of the trigger resource in the format "group/version".
-For core resources, use "v1". - |
- true | -
| kind | -string | -
- Kind is the kind of the trigger resource. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| expression | -string | -
- Expression specifies the CEL expression to evaluate against the trigger resource.
-This is a pure CEL expression WITHOUT {{ }} delimiters (unlike template fields).
-Must return a boolean value (true to match, false to skip).
-Maximum 1024 characters.
-
-Available variables in GrantCreationPolicy context:
-- trigger: The complete resource being watched (map[string]any)
- - trigger.metadata.name, trigger.spec.*, trigger.status.*, etc.
-
-Common expression patterns:
-- trigger.spec.tier == "premium" (check resource field)
-- trigger.metadata.labels["environment"] == "prod" (check labels)
-- trigger.status.phase == "Active" (check status)
-- trigger.metadata.namespace == "production" (check namespace)
-- has(trigger.spec.quotaProfile) (check field existence) - |
- true | -
| message | -string | -
- Message provides a human-readable description explaining when this condition applies.
-Used for documentation and debugging. Maximum 256 characters.
-
-Examples:
-- "Applies only to premium tier organizations"
-- "Matches organizations in production environment"
-- "Triggers when quota profile is specified" - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions represent the latest available observations of the policy's current state. - |
- false | -
| observedGeneration | -integer | -
- ObservedGeneration is the most recent generation observed. - - Format: int64 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -quota.miloapis.com/v1alpha1 | -true | -
| kind | -string | -ResourceClaim | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- ResourceClaimSpec defines the desired state of ResourceClaim. - |
- true | -
| status | -object | -
- ResourceClaimStatus reports the claim's processing state and allocation
-results. The system updates this status to communicate whether quota was
-granted and provide detailed allocation information for each requested
-resource type. - - Default: map[conditions:[map[lastTransitionTime:1970-01-01T00:00:00Z message:Awaiting capacity evaluation reason:PendingEvaluation status:False type:Granted]]] - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| requests | -[]object | -
- Requests specifies the resource types and amounts being claimed from quota.
-Each resource type can appear only once in the requests array. Minimum 1
-request, maximum 20 requests per claim.
-
-The system processes all requests as a single atomic operation: either all
-requests are granted or all are denied. - |
- true | -
| consumerRef | -object | -
- ConsumerRef identifies the quota consumer making this claim. The consumer
-must match the ConsumerType defined in the ResourceRegistration for each
-requested resource type. The system validates this relationship during
-claim processing.
-
-When creating ResourceClaims via ClaimCreationPolicy, this field can be
-omitted and the admission plugin will automatically fill it based on the
-authenticated user's context (organization or project).
-
-Examples:
-
- - Organization consuming Project quota
- - Project consuming User quota
- - Organization consuming storage quota - |
- false | -
| resourceRef | -object | -
- ResourceRef identifies the actual Kubernetes resource that triggered this
-claim. ClaimCreationPolicy automatically populates this field during
-admission. Uses unversioned reference (apiGroup + kind + name + namespace)
-to remain valid across API version changes.
-
-The referenced resource's kind must be listed in the ResourceRegistration's
-spec.claimingResources for the claim to be valid.
-
-Examples:
-
- - Project resource triggering Project quota claim
- - User resource triggering User quota claim
- - Organization resource triggering storage quota claim - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| amount | -integer | -
- Amount specifies how much quota to claim for this resource type. Must be
-measured in the BaseUnit defined by the corresponding ResourceRegistration.
-Must be a positive integer (minimum value is 0, but 0 means no quota
-requested).
-
-For Entity registrations: Use 1 for single resource instances (1 Project, 1
-User) For Allocation registrations: Use actual capacity amounts (2048 for
-2048 MB, 1000 for 1000 millicores)
-
-Examples:
-
- - 1 (claiming 1 Project)
- - 2048 (claiming 2048 bytes of storage)
- - 1000 (claiming 1000 CPU millicores) - - Format: int64 - Minimum: 0 - |
- true | -
| resourceType | -string | -
- ResourceType identifies the specific resource type being claimed. Must
-exactly match a ResourceRegistration.spec.resourceType that is currently
-active. The quota system validates this reference during claim processing.
-
-The format is defined by platform administrators when creating ResourceRegistrations.
-Service providers can use any identifier that makes sense for their quota system usage.
-
-Examples:
-
- - "resourcemanager.miloapis.com/projects"
- - "compute_cpu"
- - "storage.volumes"
- - "custom-service-quota" - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -string | -
- Kind specifies the type of consumer resource.
-Must match an existing Kubernetes resource type that can receive quota grants.
-
-Common consumer types:
-- "Organization" (top-level quota consumer)
-- "Project" (project-level quota consumer)
-- "User" (user-level quota consumer) - |
- true | -
| name | -string | -
- Name identifies the specific consumer resource instance.
-Must match the name of an existing consumer resource in the cluster.
-
-Examples:
-- "acme-corp" (Organization name)
-- "web-application" (Project name)
-- "john.doe" (User name) - |
- true | -
| apiGroup | -string | -
- APIGroup specifies the API group of the consumer resource.
-Use full group name for Milo resources.
-
-Examples:
-- "resourcemanager.miloapis.com" (Organization/Project resources)
-- "iam.miloapis.com" (User/Group resources)
-- "infrastructure.miloapis.com" (infrastructure resources) - |
- false | -
| namespace | -string | -
- Namespace identifies the namespace of the consumer resource.
-Required for namespaced consumer resources (e.g., Projects).
-Leave empty for cluster-scoped consumer resources (e.g., Organizations).
-
-Examples:
-- "" (empty for cluster-scoped Organizations)
-- "organization-acme-corp" (namespace for Projects within an organization)
-- "project-web-app" (namespace for resources within a project) - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -string | -
- Kind specifies the type of the referenced resource.
-Must match an existing Kubernetes resource type.
-
-Examples:
-- "Project" (Project resource that triggered quota claim)
-- "User" (User resource that triggered quota claim)
-- "Organization" (Organization resource that triggered quota claim) - |
- true | -
| name | -string | -
- Name identifies the specific resource instance that triggered the quota claim.
-Used for linking claims back to their triggering resources.
-
-Examples:
-- "web-app-project" (Project that triggered Project quota claim)
-- "john.doe" (User that triggered User quota claim) - |
- true | -
| apiGroup | -string | -
- APIGroup specifies the API group of the referenced resource.
-Use full group name for Milo resources.
-
-Examples:
-- "resourcemanager.miloapis.com" (Project, Organization)
-- "iam.miloapis.com" (User, Group)
-- "infrastructure.miloapis.com" (infrastructure resources) - |
- false | -
| namespace | -string | -
- Namespace specifies the namespace containing the referenced resource.
-Required for namespaced resources, omitted for cluster-scoped resources.
-
-Examples:
-- "acme-corp" (organization namespace containing Project)
-- "team-alpha" (project namespace containing User)
-- "" or omitted (for cluster-scoped resources like Organization) - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| allocations | -[]object | -
- Allocations provides detailed status for each resource request in the
-claim. The system creates one allocation entry for each request in
-spec.requests. Use this field to understand which specific requests were
-granted or denied.
-
-List is indexed by ResourceType for efficient lookups. - |
- false | -
| conditions | -[]object | -
- Conditions represents the overall status of the claim evaluation.
-Controllers set these conditions to provide a high-level view of claim
-processing.
-
-Standard condition types:
-
- - "Granted": Indicates whether the claim was approved and quota allocated
-
-Standard condition reasons for "Granted":
-
- - "QuotaAvailable": All requested quota was available and allocated
- - "QuotaExceeded": Insufficient quota prevented allocation (claim denied)
- - "ValidationFailed": Configuration errors prevented evaluation (claim denied)
- - "PendingEvaluation": Claim is still being processed (initial state)
-
-Claim Lifecycle:
-
- 1. Created: Granted=False, reason=PendingEvaluation
- 2. Processed: Granted=True/False based on quota availability and validation
- 3. Updated: Granted condition changes only when allocation results change - - Validations: |
- false | -
| observedGeneration | -integer | -
- ObservedGeneration indicates the most recent spec generation the system has
-processed. When ObservedGeneration matches metadata.generation, the status
-reflects the current spec. When ObservedGeneration is lower, the system is
-still processing recent changes. - - Format: int64 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- LastTransitionTime records when this allocation status last changed.
-Updates whenever Status, Reason, or Message changes. - - Format: date-time - |
- true | -
| resourceType | -string | -
- ResourceType identifies which resource request this allocation status
-describes. Must exactly match one of the resourceType values in
-spec.requests. - |
- true | -
| status | -enum | -
- Status indicates the allocation result for this specific resource request.
-
-Valid values:
-
- - "Granted": Quota was available and the request was approved
- - "Denied": Insufficient quota or validation failure prevented allocation
- - "Pending": Request is being evaluated (initial state) - - Enum: Granted, Denied, Pending - |
- true | -
| allocatedAmount | -integer | -
- AllocatedAmount specifies how much quota was actually allocated for this
-request. Measured in the BaseUnit defined by the ResourceRegistration.
-Currently always equals the requested amount or 0 (partial allocations not
-supported).
-
-Set to the requested amount when Status=Granted, 0 when Status=Denied or
-Pending. - - Format: int64 - Minimum: 0 - |
- false | -
| allocatingBucket | -string | -
- AllocatingBucket identifies the AllowanceBucket that provided the quota for
-this request. Set only when Status=Granted. Used for tracking and debugging
-quota consumption.
-
-Format: bucket name (generated as:
-consumer-kind-consumer-name-resource-type-hash) - |
- false | -
| message | -string | -
- Message provides a human-readable explanation of the allocation result.
-Includes specific details about quota availability or validation errors.
-
-Examples:
-
- - "Allocated 1 project from bucket organization-acme-projects"
- - "Insufficient quota: need 2048 bytes, only 1024 available"
- - "ResourceRegistration not found for resourceType" - |
- false | -
| reason | -string | -
- Reason provides a machine-readable explanation for the current status.
-Standard reasons include "QuotaAvailable", "QuotaExceeded",
-"ValidationFailed". - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -quota.miloapis.com/v1alpha1 | -true | -
| kind | -string | -ResourceGrant | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- ResourceGrantSpec defines the desired state of ResourceGrant. - |
- true | -
| status | -object | -
- ResourceGrantStatus reports the grant's operational state and processing status.
-Controllers update status conditions to indicate whether the grant is active
-and contributing capacity to AllowanceBuckets. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| allowances | -[]object | -
- Allowances specifies the quota allocations provided by this grant.
-Each allowance grants capacity for a specific resource type.
-Minimum 1 allowance required, maximum 20 allowances per grant.
-
-All allowances in a single grant:
-- Apply to the same consumer (spec.consumerRef)
-- Contribute to the same AllowanceBucket for each resource type
-- Activate and deactivate together based on the grant's status - |
- true | -
| consumerRef | -object | -
- ConsumerRef identifies the quota consumer that receives these allowances.
-The consumer type must match the ConsumerType defined in the ResourceRegistration
-for each allowance resource type. The system validates this relationship.
-
-Examples:
-- Organization receiving Project quota allowances
-- Project receiving User quota allowances
-- Organization receiving storage quota allowances - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| buckets | -[]object | -
- Buckets contains the quota allocations for this resource type.
-All bucket amounts are summed to determine the total allowance.
-Minimum 1 bucket required per allowance.
-
-Multiple buckets can be used for:
-- Separating quota from different sources or tiers
-- Managing incremental quota increases over time
-- Tracking quota attribution for billing or reporting - |
- true | -
| resourceType | -string | -
- ResourceType identifies the specific resource type receiving quota allocation.
-Must exactly match a ResourceRegistration.spec.resourceType that is currently active.
-The quota system validates this reference when processing the grant.
-
-The identifier format is flexible, as defined by platform administrators
-in their ResourceRegistrations.
-
-Examples:
-- "resourcemanager.miloapis.com/projects"
-- "compute_cpu"
-- "storage.volumes"
-- "custom-service-quota" - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| amount | -integer | -
- Amount specifies the quota capacity provided by this bucket.
-Must be measured in the BaseUnit defined by the corresponding ResourceRegistration.
-Must be a non-negative integer (0 is valid but provides no quota).
-
-Examples:
-- 100 (providing 100 projects)
-- 2048000 (providing 2048000 bytes = 2GB)
-- 5000 (providing 5000 CPU millicores = 5 cores) - - Format: int64 - Minimum: 0 - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -string | -
- Kind specifies the type of consumer resource.
-Must match an existing Kubernetes resource type that can receive quota grants.
-
-Common consumer types:
-- "Organization" (top-level quota consumer)
-- "Project" (project-level quota consumer)
-- "User" (user-level quota consumer) - |
- true | -
| name | -string | -
- Name identifies the specific consumer resource instance.
-Must match the name of an existing consumer resource in the cluster.
-
-Examples:
-- "acme-corp" (Organization name)
-- "web-application" (Project name)
-- "john.doe" (User name) - |
- true | -
| apiGroup | -string | -
- APIGroup specifies the API group of the consumer resource.
-Use full group name for Milo resources.
-
-Examples:
-- "resourcemanager.miloapis.com" (Organization/Project resources)
-- "iam.miloapis.com" (User/Group resources)
-- "infrastructure.miloapis.com" (infrastructure resources) - |
- false | -
| namespace | -string | -
- Namespace identifies the namespace of the consumer resource.
-Required for namespaced consumer resources (e.g., Projects).
-Leave empty for cluster-scoped consumer resources (e.g., Organizations).
-
-Examples:
-- "" (empty for cluster-scoped Organizations)
-- "organization-acme-corp" (namespace for Projects within an organization)
-- "project-web-app" (namespace for resources within a project) - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions represents the latest available observations of the grant's state.
-Controllers set these conditions to communicate operational status.
-
-Standard condition types:
-- "Active": Indicates whether the grant is operational and contributing to quota buckets.
- When True, allowances are aggregated into AllowanceBuckets and available for claims.
- When False, allowances do not contribute to quota decisions.
-
-Standard condition reasons for "Active":
-- "GrantActive": Grant is validated and contributing to quota buckets
-- "ValidationFailed": Specification contains errors preventing activation (see message)
-- "GrantPending": Grant is being processed by the quota system
-
-Grant Lifecycle:
-1. Created: Active=Unknown, reason=GrantPending
-2. Validated: Active=True, reason=GrantActive OR Active=False, reason=ValidationFailed
-3. Updated: Active condition changes only when validation results change - - Validations: |
- false | -
| observedGeneration | -integer | -
- ObservedGeneration indicates the most recent spec generation the quota system has processed.
-When ObservedGeneration matches metadata.generation, the status reflects the current spec.
-When ObservedGeneration is lower, the quota system is still processing recent changes. - - Format: int64 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -string | -
- Kind specifies the resource type that can create **ResourceClaims** for this registration.
-Must match an existing resource type. Maximum 63 characters.
-
-Examples:
-- `Project` (**Project** resource creating claims for **Project** quota)
-- `User` (**User** resource creating claims for **User** quota)
-- `Organization` (**Organization** resource creating claims for **Organization** quota) - |
- true | -
| apiGroup | -string | -
- APIGroup specifies the API group of the resource that can create claims.
-Use empty string for Kubernetes core resources (**Secret**, **ConfigMap**, etc.).
-Use full group name for custom resources.
-
-Examples:
-- `""` (core resources like **Secret**, **ConfigMap**)
-- `resourcemanager.miloapis.com` (custom resource group)
-- `iam.miloapis.com` (Milo IAM resources) - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiGroup | -string | -
- APIGroup specifies the API group of the quota consumer resource type.
-Use empty string for Kubernetes core resources (**Secret**, **ConfigMap**, etc.).
-Use full group name for custom resources (for example, `resourcemanager.miloapis.com`).
-Must follow DNS subdomain format with lowercase letters, numbers, and hyphens.
-
-Examples:
-- `resourcemanager.miloapis.com` (**Organizations**, **Projects**)
-- `iam.miloapis.com` (**Users**, **Groups**)
-- `infrastructure.miloapis.com` (custom infrastructure resources) - |
- true | -
| kind | -string | -
- Kind specifies the resource type that receives quota grants and creates quota claims.
-Must match an existing Kubernetes resource type (core or custom).
-Use the exact Kind name as defined in the resource's schema.
-
-Examples:
-- **Organization** (receives **Project** quotas)
-- **Project** (receives **User** quotas)
-- **User** (receives resource quotas within projects) - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions represents the latest available observations of the registration's state.
-The system sets these conditions to communicate operational status.
-
-Standard condition types:
-- "Active": Indicates whether the registration is operational. When True, ResourceGrants
- and ResourceClaims can reference this registration. When False, quota operations are blocked.
-
-Standard condition reasons for "Active":
-- "RegistrationActive": Registration is validated and operational
-- "ValidationFailed": Specification contains errors (see message for details)
-- "RegistrationPending": Registration is being processed - - Validations: |
- false | -
| observedGeneration | -integer | -
- ObservedGeneration indicates the most recent spec generation that the system has processed.
-When ObservedGeneration matches metadata.generation, the status reflects the current spec.
-When ObservedGeneration is lower, the system is still processing recent changes. - - Format: int64 +- "Storage bytes claimed by volume requests" +- "Feature flag X enabled for organizations" (for Feature registrations) + |
false |
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -