WorkerPool.spec.pod.initContainer.securityContext.seLinuxOptions.spec

AllowedRunnerImageHosts is a set of container image base URLs (for example ghcr.io or docker.io) that are allowed to be used as runner images. When set, any runs that are scheduled using a host not found in the list will be marked as failed. When not set, any container image is allowed.

CommsProtocol selects the transport used to communicate with the Spacelift backend for this pool's workers: "mqtt" (default, server push over MQTT) or "poll" (worker-initiated HTTP long-poll). All workers in the pool use the selected transport.

• enum: ["mqtt","poll"]
• default: "mqtt"

description sets the pool description.

DriftDetectionRunLimit configures limits for drift detection runs executed on this worker pool.

• x-kubernetes-validations: [{"message":"maxRuns cannot be set when disabled is true","rule":"!self.disabled || !has(self.maxRuns)"},{"message":"either disabled must be true or maxRuns must be set","rule":"self.disabled || has(self.maxRuns)"}]

FailedPodsHistoryLimit specifies the number of failed Pods to keep for debugging purposes. When set to a positive number, only the N most recent failed Pods are kept per worker. When set to 0, all failed Pods are removed immediately. When unset and FailedPodsHistoryTTL is also unset, defaults to 5 (keep 5 most recent). When unset but FailedPodsHistoryTTL is set, count-based cleanup is disabled (TTL-only).

• format: int32
• minimum: 0

FailedPodsHistoryTTL specifies the duration to keep failed Pods after they are created. When set, failed Pods that have been created for longer than this duration are removed. The TTL timer starts from Pod creation time for consistency with history limit ordering. Running pods are never affected by this TTL. When unset (nil), no time-based cleanup is performed for failed Pods. This works in combination with FailedPodsHistoryLimit - pods are removed if they exceed EITHER limit.

MqttReconnectRetryCount defines how many times the worker will try to connect to the MQTT broker in case of failure during the initial connection. Default is 5.

• default: 5

Pod contains the configuration options for Pods created as a result of runs being scheduled on the pool.

PollCommsURL is the base URL of the Spacelift worker communication server used when CommsProtocol is "poll" (for example https://app.spacelift.io). It is required when CommsProtocol is "poll" and ignored otherwise.

PoolSize is the desired size of your worker pool.

• format: int32
• minimum: 0

Private key is the key generated when creating your worker pool. Must be set together with token, or both must be unset.

space allows us to choose where the pool is created.

SpaceliftAPICredentials references a secret containing API credentials. This takes precedence over the controller level credentials

SuccessfulPodsHistoryLimit specifies the number of successful Pods to keep for inspection purposes. When set to a positive number, only the N most recent successful Pods are kept per worker. When set to 0, all successful Pods are removed immediately. When unset and SuccessfulPodsHistoryTTL is also unset, defaults to 0 (remove all). When unset but SuccessfulPodsHistoryTTL is set, count-based cleanup is disabled (TTL-only).

• format: int32
• minimum: 0

SuccessfulPodsHistoryTTL specifies the duration to keep successful Pods after they are created. When set, successful Pods that have been created for longer than this duration are removed. The TTL timer starts from Pod creation time for consistency with history limit ordering. Running pods are never affected by this TTL. When unset (nil), no time-based cleanup is performed for successful Pods. This works in combination with SuccessfulPodsHistoryLimit - pods are removed if they exceed EITHER limit.

Token is the token generated when creating your worker pool. Must be set together with privateKey, or both must be unset.