{"id":29228408,"url":"https://github.com/restatedev/restate-operator","last_synced_at":"2026-01-16T18:29:09.379Z","repository":{"id":226173757,"uuid":"753536642","full_name":"restatedev/restate-operator","owner":"restatedev","description":"Deploy Restate clusters easily on Kubernetes","archived":false,"fork":false,"pushed_at":"2026-01-12T21:16:26.000Z","size":357,"stargazers_count":43,"open_issues_count":6,"forks_count":14,"subscribers_count":5,"default_branch":"main","last_synced_at":"2026-01-13T01:53:31.787Z","etag":null,"topics":["kubernetes","operator","restate"],"latest_commit_sha":null,"homepage":"https://restate.dev/","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/restatedev.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-02-06T10:15:12.000Z","updated_at":"2026-01-12T23:20:50.000Z","dependencies_parsed_at":"2024-03-13T13:56:19.582Z","dependency_job_id":"8892ff9c-d3b7-4277-a854-4b3bc507787d","html_url":"https://github.com/restatedev/restate-operator","commit_stats":null,"previous_names":["restatedev/restate-operator"],"tags_count":57,"template":false,"template_full_name":null,"purl":"pkg:github/restatedev/restate-operator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/restatedev%2Frestate-operator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/restatedev%2Frestate-operator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/restatedev%2Frestate-operator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/restatedev%2Frestate-operator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/restatedev","download_url":"https://codeload.github.com/restatedev/restate-operator/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/restatedev%2Frestate-operator/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28480814,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-16T11:59:17.896Z","status":"ssl_error","status_checked_at":"2026-01-16T11:55:55.838Z","response_time":107,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["kubernetes","operator","restate"],"created_at":"2025-07-03T10:10:50.894Z","updated_at":"2026-01-16T18:29:09.359Z","avatar_url":"https://github.com/restatedev.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Restate Operator\n\nA Kubernetes operator that creates [Restate](https://restate.dev/) clusters. Supported features:\n\n- Online volume expansion\n- Network security via `NetworkPolicy`\n- Manage credentials using [EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html)\n- Manage security groups using [Security Groups for Pods](https://docs.aws.amazon.com/eks/latest/userguide/security-groups-for-pods.html)\n- Sign requests using private keys from Secrets or CSI Secret Store\n- Deploy Restate SDK services using the `RestateDeployment` crd, the operator will manage their versions automatically, draining\n  old versions when there are no longer invocations running against them.\n\n## Installation\n\n```bash\nhelm install restate-operator \\\n  oci://ghcr.io/restatedev/restate-operator-helm \\\n  --namespace restate-operator \\\n  --create-namespace\n```\n\nTo render the chart templates locally for inspection or for use with a GitOps workflow, you can use `helm template`. For example, to a file named `manifests.yaml`:\n\n```bash\nhelm template restate-operator oci://ghcr.io/restatedev/restate-operator-helm \\\n  --namespace restate-operator \\\n  --create-namespace \\\n  --include-crds \\\n  \u003e manifests.yaml\n```\n\nOptionally split these into separate files for each kind:\n\n```bash\n# brew install yq\n# For CRDs, include the metadata.name in the filename to avoid collisions.\nyq eval 'select(.kind == \"CustomResourceDefinition\")' manifests.yaml | \\\n  yq eval --split-exp '\"k8s/base/\" + (.metadata.name | downcase) + \"-\" + (.kind | downcase) + \".yaml\"' -\n\n# For all others, just use the kind.\nyq eval 'select(.kind != \"CustomResourceDefinition\")' manifests.yaml | \\\n  yq eval --split-exp '\"k8s/base/\" + (.kind | downcase) + \".yaml\"' -\n```\n\n## Custom Resource Definitions\n\nThe operator introduces three Custom Resource Definitions (CRDs): `RestateCluster`, `RestateDeployment`, and `RestateCloudEnvironment`.\n\n### `RestateCluster`\n\nThe `RestateCluster` CRD defines a Restate cluster. The operator watches for these objects and creates the necessary Kubernetes resources, such as `StatefulSet`, `Service`, and `NetworkPolicy` objects in a new namespace that matches the `RestateCluster` name.\n\n**By default, the operator enforces network isolation on the cluster, allowing only the following**:\n1. Peer to peer traffic between Restate pods\n2. Traffic from the operator to Restate pods\n3. Egress traffic to the public internet\n4. Egress traffic to coredns\n4. Egress traffic to pods in any namespace labelled with `allow.restate.dev/\u003ccluster-name\u003e`\n\n**All other traffic is denied by default.**\n\nThe default behaviour can be disabled with `spec.security.disableNetworkPolicies: true`.\nAlternatively, you can add new allowed inbound callers of the Restate ports with `spec.security.networkPeers.{ingress,admin,node}`, which are arrays of [`NetworkPolicyPeer`](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#networkpolicypeer-v1-networking-k8s-io).\nYou can allow new outbound destinations by adding to the `spec.security.networkEgressRules` list, which is an array of [`NetworkPolicyEgressRule`](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#networkpolicyegressrule-v1-networking-k8s-io).\n\n**NOTE**: Each cluster is created in its own namespace. Naming the cluster after an existing Namespace is supported, but deploying into namespaces with other applications is not recommended.\n\n#### Minimal Example\n\nAn example `RestateCluster` with one node:\n\n```yaml\napiVersion: restate.dev/v1\nkind: RestateCluster\nmetadata:\n  name: restate-test\nspec:\n  cluster:\n    autoProvision: true\n  compute:\n    image: restatedev/restate:1.5\n  storage:\n    storageRequestBytes: 2147483648 # 2 GiB\n  config: |\n    auto-provision = false\n```\n\nFor the full schema as a [Pkl](https://pkl-lang.org/) template see [`crd/RestateCluster.pkl`](./crd/RestateCluster.pkl).\n\nMore examples are available just below the spec that follows.\n\n#### Spec Fields\n\n| Field | Type | Description |\n|---|---|---|\n| `compute` | `object` | Compute configuration. See details below. |\n| `storage` | `object` | Storage configuration. See details below. |\n| `security` | `object` | Security configuration. See details below. |\n| `cluster` | `object` | Cluster-wide configuration options. See details below. |\n| `config` | `string` | TOML-encoded Restate config file. See details below. |\n| `clusterName` | `string` | Sets the `RESTATE_CLUSTER_NAME` environment variable. Defaults to the object name. |\n\n---\n\n#### `spec.compute`\n\n| Field | Type | Description |\n|---|---|---|\n| `replicas` | `integer` | The desired number of Restate nodes. Defaults to 1. |\n| `image` | `string` | **Required**. Container image name. |\n| `imagePullPolicy` | `string` | Image pull policy. One of `Always`, `Never`, `IfNotPresent`. Defaults to `Always` if `:latest` tag is specified, or `IfNotPresent` otherwise. |\n| `imagePullSecrets` | `array` | Optional list of references to secrets in the same namespace to use for pulling the image. |\n| `resources` | `object` | Compute Resources for the Restate container. e.g., `requests` and `limits` for `cpu` and `memory`. |\n| `env` | `array` | List of environment variables to set in the container. |\n| `affinity` | `object` | Standard Kubernetes affinity rules. |\n| `nodeSelector` | `object` | Standard Kubernetes node selector. |\n| `tolerations` | `array` | Standard Kubernetes tolerations. |\n| `dnsPolicy` | `string` | Pod DNS policy. |\n| `dnsConfig` | `object` | Pod DNS configuration. |\n\n---\n\n#### `spec.storage`\n\n| Field | Type | Description |\n|---|---|---|\n| `storageRequestBytes` | `integer` | **Required**. Amount of storage to request in volume claims. Can be increased but not decreased. |\n| `storageClassName` | `string` | The name of the `StorageClass` for the volume claims. This field is immutable. |\n| `volumeAttributesClassName` | `string` | The name of the `VolumeAttributesClass` for the volume claims. |\n\n---\n\n#### `spec.cluster`\n\n| Field | Type | Description |\n|---|---|---|\n| `autoProvision` | `boolean` | If `true`, the operator will automatically provision the cluster via gRPC after pods are running. Defaults to `false`. |\n\n\u003e ⚠️ **Important**: When `cluster.autoProvision` is set to `true`, you **must** disable all other forms of cluster provisioning:\n\u003e - Set `auto-provision = false` in `spec.config`, or set the `RESTATE_AUTO_PROVISION=false` environment variable\n\u003e - Do not use any sidecar containers or init containers that run `restatectl provision`\n\u003e - Do not manually provision the cluster\n\u003e\n\u003e Running multiple provisioning methods simultaneously can lead to split brain situations in the Restate cluster.\n\nWhen enabled, the operator will:\n1. Wait for the `restate-0` pod to be in `Running` state\n2. Call the Restate gRPC `ProvisionCluster` API\n3. Set `status.provisioned = true` to avoid repeated provisioning attempts\n\nThis feature is particularly useful for Raft-based metadata clusters where manual provisioning was previously required.\n\n---\n\n#### `spec.security`\n\n| Field | Type | Description |\n|---|---|---|\n| `disableNetworkPolicies` | `boolean` | If `true`, the operator will not create any network policies. Defaults to `false`. |\n| `allowOperatorAccessToAdmin` | `boolean` | If `true`, adds a rule to allow the operator to access the admin API. Needed for `RestateDeployment`. Defaults to `true`. |\n| `networkPeers` | `object` | Defines network peers to allow inbound access to `admin`, `ingress`, and `node` ports. |\n| `networkEgressRules` | `array` | Custom egress rules for outbound traffic from the cluster. |\n| `serviceAccountAnnotations` | `object` | Annotations to add to the `ServiceAccount`. |\n| `serviceAnnotations`| `object` | Annotations to add to the `Service`. |\n| `awsPodIdentityAssociationRoleArn` | `string` | **Use this to grant your Restate cluster fine-grained access to other AWS resources (like S3) without managing static credentials.** Creates a `PodIdentityAssociation` to grant the cluster an IAM role. Requires the ACK EKS controller. |\n| `awsPodSecurityGroups` | `array` | **Use this to isolate your Restate cluster within specific AWS Security Groups for enhanced network control and auditing.** Creates a `SecurityGroupPolicy` to place pods into these security groups. Requires the Security Groups for Pods CRD. |\n| `requestSigningPrivateKey` | `object` | Configures a private key to sign outbound requests from this cluster. Can be sourced from a `secret` or a CSI `secretProvider`. See details below. |\n\n---\n\n#### `spec.security.requestSigningPrivateKey`\n\n| Field | Type | Description |\n|---|---|---|\n| `version` | `string` | **Required**. The version of Restate request signing. Currently, only \"v1\" is accepted. |\n| `secret` | `object` | A Kubernetes Secret source for the private key. |\n| `secretProvider` | `object` | A CSI secret provider source for the private key. |\n\n**`secret` Fields**\n\n| Field | Type | Description |\n|---|---|---|\n| `secretName` | `string` | **Required**. The name of the secret. |\n| `key` | `string` | **Required**. The key within the secret that contains the private key. |\n\n**`secretProvider` Fields**\n\n| Field | Type | Description |\n|---|---|---|\n| `provider` | `string` | The name of the CSI secret provider (e.g., `secrets-store.csi.k8s.io`). |\n| `path` | `string` | **Required**. The path of the private key file within the mounted volume. |\n| `parameters` | `object` | Provider-specific configuration parameters. |\n\n---\n\n#### `spec.config`\n\nThis field allows you to provide a TOML-encoded configuration string for the Restate server. This maps directly to the Restate server's configuration file. You can use this to configure aspects like roles, metadata storage, snapshotting, and more.\n\nFor a complete list of configuration options, see the [official Restate Server Configuration Reference](https://docs.restate.dev/references/server_config).\n\n#### Key `spec.config` Options\n\nWhile the `config` field accepts any valid [Restate server configuration](https://docs.restate.dev/references/server_config), some options are particularly important for defining the cluster's topology and behavior.\n\n*   **`roles`**: An array of strings defining the functions of the nodes in the cluster. Common roles include:\n    *   `worker`: Executes service code.\n    *   `admin`: Provides the administration API for deployments and cluster management.\n    *   `log-server`: Part of the replicated log for durable state.\n    *   `metadata-server`: Part of the Raft-based replicated metadata store. Not required if using object store for metadata.\n    *   `http-ingress`: Exposes an HTTP endpoint for invoking services.\n\n*   **`[metadata-client]`**: Configures how the cluster stores its core metadata. This is a critical choice for production deployments.\n    *   `type = \"replicated\"`: Uses a built-in Raft consensus protocol. This is simpler to set up but requires careful management of the Raft cluster members.\n    *   `type = \"object-store\"`: Uses an S3-compatible object store for metadata, which is simpler to operate particularly if using an object store for snapshots. You must provide the `path` to the bucket.\n\n*   **`[worker.snapshots]`**: Configures durable snapshots of service state, which is essential for fault tolerance and fast recovery.\n    *   `destination`: The S3 URI where snapshots will be stored (e.g., `s3://my-bucket/snapshots`).\n    *   `snapshot-interval-num-records`: How many log records are processed in a particular partition before a new snapshot is taken.\n\n*   **`auto-provision`**: A boolean that controls whether the Restate node should automatically initialize itself. **When using `cluster.autoProvision: true` (recommended), this must be set to `false`.** If not using operator-managed provisioning, this can be `true` for object-store metadata but must be `false` for `replicated` (Raft) metadata store.\n\n*   **Resource Management**:\n    *   `rocksdb-total-memory-size`: Sets the total memory allocated to RocksDB, which Restate uses for its internal state storage. Typically 75% of the memory requests for the pod is appropriate.\n    *   `admin.query-engine.memory-size`: Allocates memory for the admin service's query engine.\n\nFor a complete list of all available options, please refer to the [official Restate Server Configuration Reference](https://docs.restate.dev/references/server_config).\n\nIf you don't have access to an object store that supports conditional PUTs for metadata, you can run using the default Raft-based metadata store. The following is an example of a `RestateCluster` configured for Raft metadata without snapshots. Note that running a distributed cluster without snapshots is not recommended as they are used to speed up failover.\n\n```yaml\napiVersion: restate.dev/v1\nkind: RestateCluster\nmetadata:\n  name: restate-test\nspec:\n  cluster:\n    autoProvision: true\n  compute:\n    replicas: 3\n    image: restatedev/restate:1.5\n  storage:\n    storageRequestBytes: 2147483648 # 2 GiB\n  config: |\n    roles = [\n        \"worker\",\n        \"admin\",\n        \"log-server\",\n        \"metadata-server\",\n        \"http-ingress\",\n    ]\n    # auto-provision must be false when using operator-managed provisioning\n    auto-provision = false\n    default-num-partitions = 128\n    default-replication = 2\n\n    [metadata-client]\n    addresses = [\"http://restate-cluster:5122/\"]\n```\n\n#### Advanced Example\n\n\u003e ⚠️ **Supported object stores for metadata:** Only AWS S3 is currently tested and supported as a metadata backend.\n  We are aware of issues with GCS and with MinIO's consistency models that make them an unsafe choice for metadata,\n  but they can be used for snapshots where consistency is not needed.\n\nAn example `RestateCluster` with 3 nodes using S3 for metadata and [snapshots](https://docs.restate.dev/operate/snapshots/):\n\n```yaml\napiVersion: restate.dev/v1\nkind: RestateCluster\nmetadata:\n  name: restate-test\nspec:\n  cluster:\n    autoProvision: true\n  compute:\n    replicas: 3\n    image: restatedev/restate:1.5\n  storage:\n    storageRequestBytes: 2147483648 # 2 GiB\n  security:\n    # this kind of annotation can be used to give your cluster an IAM role in EKS\n    serviceAccountAnnotations:\n      eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/my-role-that-can-read-write-to-the-bucket\n  config: |\n    roles = [\n        \"worker\",\n        \"admin\",\n        \"log-server\",\n        \"http-ingress\",\n    ]\n    # auto-provision must be false when using operator-managed provisioning\n    auto-provision = false\n    default-num-partitions = 128\n    default-replication = 2\n\n    [metadata-client]\n    type = \"object-store\"\n    path = \"s3://some-bucket/metadata\"\n    # the same aws-* parameters as below are supported here\n\n    [worker.snapshots]\n    destination = \"s3://some-bucket/snapshots\"\n    snapshot-interval-num-records = 10000\n    # you can also provide parameters here for non-S3 stores eg:\n    # aws-region = \"local\"\n    # aws-access-key-id = \"minioadmin\"\n    # aws-secret-access-key = \"minioadmin\"\n    # aws-endpoint-url = \"http://localhost:9000\"\n    # aws-allow-http = true\n```\n\nNote that Restate needs `s3:ListBucket` on the bucket, and `s3:GetObject`/`s3:PutObject` on the bucket contents.\n\n#### MinIO example\nSee [docs/minio.md](./docs/minio.md)\n\n### `RestateDeployment`\n\nThe `RestateDeployment` CRD is similar to a standard Kubernetes `Deployment` but is tailored for deploying Restate services. It manages `ReplicaSet` and `Service` objects for each version of your service, which is crucial for Restate's versioning and draining capabilities. This ensures that old service versions remain available until all in-flight invocations are completed.\n\n#### Example\n\n```yaml\napiVersion: restate.dev/v1beta1\nkind: RestateDeployment\nmetadata:\n  name: my-deployment\nspec:\n  replicas: 1\n  restate:\n    register:\n      cluster: restate-test\n  selector:\n    matchLabels:\n      app: my-deployment\n  template:\n    metadata:\n      labels:\n        app: my-deployment\n    spec:\n      containers:\n      - name: app\n        image: my-restate-service-image:main\n        ports:\n        - name: restate\n          containerPort: 9080\n```\nFor the full schema as a [Pkl](https://pkl-lang.org/) template see [`crd/RestateDeployment.pkl`](./crd/RestateDeployment.pkl).\n\n#### Spec Fields\n\n| Field | Type | Description |\n|---|---|---|\n| `replicas` | `integer` | Number of desired pods. Defaults to 1. |\n| `selector` | `object` | **Required**. Label selector for pods. Must match the pod template's labels. See details below. |\n| `template` | `object` | **Required**. Pod template for the deployment. See details below. |\n| `restate` | `object` | **Required**. Restate-specific configuration. See details below. |\n| `minReadySeconds` | `integer` | Minimum seconds a new pod should be ready before it's considered available. Defaults to 0. |\n| `revisionHistoryLimit`| `integer` | Number of old ReplicaSets to retain for rollbacks. Defaults to 10. |\n\n---\n\n#### `spec.selector`\n\nThis is a standard Kubernetes [label selector](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors). It must match the labels of the pod template.\n\n| Field | Type | Description |\n|---|---|---|\n| `matchLabels` | `object` | A map of key-value pairs. |\n| `matchExpressions` | `array` | A list of label selector requirements. |\n\n---\n\n#### `spec.template`\n\nThis is a standard Kubernetes `PodTemplateSpec`. The contents of this field are passed through directly from the operator to the created `ReplicaSet` and are not validated by the operator.\n\nFor details on the `PodTemplateSpec` schema, see the [official Kubernetes API documentation](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-template-v1/#PodTemplateSpec).\n\n---\n\n#### `spec.restate`\n\nThis field contains Restate-specific configuration.\n\n| Field | Type | Description |\n|---|---|---|\n| `register` | `object` | **Required**. The location of the Restate Admin API to register this deployment against. See details below. |\n| `servicePath` | `string` | Optional path to append to the Service url when registering with Restate. |\n| `useHttp11`  | `boolean` | Force the use of HTTP/1.1 when registering with Restate. Defaults to HTTP/2 if not specified. |\n\n\nThe `register` field must specify exactly one of `cluster`, `service`, or `url`.\n\n| Field | Type | Description |\n|---|---|---|\n| `cluster` | `string` | The name of a `RestateCluster` CRD object in the same Kubernetes cluster. |\n| `cloud` | `string` | The name of a `RestateCloudEnvironment` CRD object in the same Kubernetes cluster. |\n| `service` | `object` | A reference to a Kubernetes `Service` that points to the Restate admin API. See details below. |\n| `url` | `string` | The direct URL of the Restate admin endpoint. |\n\n**`register.service` Fields**\n\n| Field | Type | Description |\n|---|---|---|\n| `name` | `string` | **Required**. The name of the service. |\n| `namespace` | `string` | **Required**. The namespace of the service. |\n| `path` | `string` | An optional URL path to be prepended to admin API paths. Should not end with a `/`. |\n| `port` | `integer` | The port on the service that hosts the admin API. Defaults to 9070. |\n\n### `RestateCloudEnvironment`\n\nThe `RestateCloudEnvironment` CRD allows you to use the `RestateDeployment` feature with a Restate Cloud environment. This resource describes a cloud environment, references a secret used to communicate with it, and manages a Deployment of tunnel pods in your Kubernetes cluster which allows Restate Cloud to call into your services without having to expose them over the public internet.\n\n#### Minimal Example\n\n```yaml\napiVersion: restate.dev/v1beta1\nkind: RestateCloudEnvironment\nmetadata:\n  name: my-cloud-environment\nspec:\n  environmentId: env_201j05r9g0f12ygtphdszbb4scp\n  signingPublicKey: publickeyv1_BBuEJnx28hdGb5Ky6qpvuXQG4aVoWBnubJtHXpznzgQk\n  region: us\n  authentication:\n    secret:\n      name: my-cloud-environment-secret\n      key: token\n```\n\n#### Spec Fields\n\n| Field | Type | Description |\n|---|---|---|\n| `environmentId` | `string` | **Required**. The environment ID of your cluster, which begins with `env_`. |\n| `region` | `string` | **Required**. The short region identifier of your cluster, e.g., `us`, `eu`. |\n| `signingPublicKey` | `string` | **Required**. The request signing public key of your cluster, which begins `publickeyv1_`. It is not a secret. |\n| `authentication` | `object` | **Required**. Where to get credentials for communication with the Cloud environment. See details below. |\n| `tunnel` | `object` | Optional configuration for the deployment of tunnel pods. See details below. |\n\n---\n\n#### `spec.authentication`\n\n| Field | Type | Description |\n|---|---|---|\n| `secret` | `object` | **Required**. A reference to a secret in the same namespace as the operator. See details below. |\n\n**`secret` Fields**\n\n| Field | Type | Description |\n|---|---|---|\n| `name` | `string` | **Required**. The name of the referenced secret. It must be in the same namespace as the operator. |\n| `key` | `string` | **Required**. The key to read from the referenced Secret. |\n\n---\n\n#### `spec.tunnel`\n\n| Field | Type | Description |\n|---|---|---|\n| `remoteProxy` | `boolean` | If true, the tunnel pods will expose unauthenticated access to the Restate Cloud environment on ports 8080 and 9070. Defaults to false. |\n| `replicas` | `integer` | The desired number of tunnel pods. Defaults to 1. |\n| `image` | `string` | Container image name. Defaults to a suggested version of the ghcr.io/restatedev/restate-cloud-tunnel-client. |\n| `imagePullPolicy` | `string` | Image pull policy. One of `Always`, `Never`, `IfNotPresent`. Defaults to `Always` if `:latest` tag is specified, or `IfNotPresent` otherwise. |\n| `env` | `array` | List of environment variables to set in the container; these may override defaults. |\n| `resources` | `object` | Compute Resources for the tunnel pods. |\n| `dnsConfig` | `object` | DNS configuration for the tunnel pod. |\n| `dnsPolicy` | `string` | DNS policy for the pod. Defaults to `ClusterFirst`. Valid values are `ClusterFirstWithHostNet`, `ClusterFirst`, `Default` or `None`. |\n| `tolerations` | `array` | Pod tolerations. |\n| `nodeSelector` | `object` | Node selector for the pod. |\n| `affinity` | `object` | Pod affinity. Defaults to zone anti-affinity, provide `{}` to disable all affinity. |\n\nMost of these fields correspond to fields in a native `DeploymentSpec`. See the [official Kubernetes API documentation] (https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/deployment-v1/#DeploymentSpec).\n\n#### Setup Instructions\n\n1. **Obtain an admin API token** from the Restate Cloud UI and place it in a secret in the same namespace as the operator:\n\n```shell\n# paste your API key into a local file\npbpaste \u003e token\n# create the Secret in the restate-operator namespace\nkubectl -n restate-operator create secret generic my-cloud-environment-secret --from-file token\n```\n\n2. **Create a RestateCloudEnvironment** referencing your environment ID, region, and token:\n\n```yaml\napiVersion: restate.dev/v1beta1\nkind: RestateCloudEnvironment\nmetadata:\n  name: my-cloud-environment\nspec:\n  environmentId: env_201j05r9g0f12ygtphdszbb4scp\n  region: us\n  authentication:\n    secret:\n      name: my-cloud-environment-secret\n      key: token\n```\n\n3. **Reference this cluster** when creating RestateDeployment objects in any namespace:\n\n```yaml\napiVersion: restate.dev/v1beta1\nkind: RestateDeployment\nmetadata:\n  name: my-deployment\nspec:\n  restate:\n    register:\n      cloud: my-cloud-environment\n```\n\n\n### EKS Pod Identity\n\n[EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) is a convenient way to have a\nsingle AWS role shared amongst many Restate clusters, where the AWS identities will contain tags detailing their\nKubernetes identity. This can be useful for access control eg 'Restate clusters in namespace `my-cluster` may call this\nLambda'.\n\nThis operator can create objects for the\n[AWS ACK EKS controller](https://github.com/aws-controllers-k8s/eks-controller) such that pod identity associations are\ncreated for each `RestateCluster`. To enable this functionality the operator must be started with knowledge of the EKS\ncluster name, by setting `awsPodIdentityAssociationCluster` in the helm chart. If this option is set, the ACK CRDs must\nbe installed or the operator will fail to start. Then, you may provide `awsPodIdentityAssociationRoleArn` in\nthe `RestateCluster` spec.\n\n### EKS Security Groups for Pods\n\n[EKS Security Groups for Pods](https://docs.aws.amazon.com/eks/latest/userguide/security-groups-for-pods.html) allows\nyou to isolate pods into separate AWS Security Groups, which is a powerful security primitive which can help you limit\nRestate to public IP access, as well as to obtain VPC flow logs.\n\nThe operator can create `SecurityGroupPolicy` objects which put Restate pods into a set of Security Groups. If this CRD\nis installed, you may provide `awsPodSecurityGroups` in the `RestateCluster` spec.\n\n## Releasing\n\n1. Update the version in `charts/restate-operator/Chart.yaml` and the version in `Cargo.{toml,lock}` eg to `0.0.2`\n2. Push a new tag `v0.0.2`\n3. Accept the draft release once the workflow finishes\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frestatedev%2Frestate-operator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frestatedev%2Frestate-operator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frestatedev%2Frestate-operator/lists"}