Skip to content

PocketIDInstance

PocketIDInstance is the Schema for the pocketidinstances API.

PocketIDInstance.spec

PocketIDInstanceSpec defines the desired state of PocketIDInstance.

Validation rules:

  • deploymentType is immutable
  • external is immutable; create a new PocketIDInstance to switch modes
  • fileBackend must be 's3' (or unset) when s3 config is present
  • encryptionKey value must be at least 16 characters
  • set exactly one of external (adopt an existing Pocket-ID) or encryptionKey (deploy a new one)
Field Type Required Default Description
deploymentType string Deployment Kind of workload to create: Deployment or StatefulSet. Defaults to Deployment and is immutable after creation.
Enum: [Deployment StatefulSet]
image string Container image to run. When unset, the operator uses the latest version tested against this release.
encryptionKey object Encryption key. Required when deploying an instance; omit for external instances.
Sets ENCRYPTION_KEY. See https://pocket-id.org/docs/configuration/environment-variables.
external object External adopts an existing Pocket-ID instead of deploying one. When set, no workload/service/PVC is created and the operator manages OIDC clients, users, and groups on that instance via its API.
Mutually exclusive with encryptionKey and the other deployment fields.
databaseUrl object Database connection string.
Sets DB_CONNECTION_STRING. See https://pocket-id.org/docs/configuration/environment-variables.
appUrl string Public URL of Pocket-ID.
Sets APP_URL. See https://pocket-id.org/docs/configuration/environment-variables.
env EnvVar array Additional environment variables to set. Uses Kubernetes env var syntax (secretKeyRef, configMapKeyRef, etc.).
persistence object Configures persistence for Pocket-ID. Pocket-ID can be run statelessly; see https://pocket-id-operator.pages.dev/examples/pocketidinstance/#stateless-deployment.
If not enabled, an emptyDir is mounted instead.
podSecurityContext PodSecurityContext Pod security context.
containerSecurityContext SecurityContext Container security context.
hostUsers boolean true Deprecated: use spec.podTemplate.hostUsers instead.
labels object (keys:string, values:string) Additional labels to add to the workload and pod.
annotations object (keys:string, values:string) Additional annotations to add to the workload and pod.
podTemplate PodTemplateSpec Pod template to merge with the operator-built pod spec. Operator-managed fields including the pocket-id container always take precedence.
Schemaless: {}
readinessProbe Probe Readiness probe configuration.
livenessProbe Probe Liveness probe configuration.
resources ResourceRequirements Resource requests and limits for the container.
metrics object Prometheus metrics configuration. When enabled, the operator injects the required OTEL environment variables and exposes a metrics port on the Service.
route object Configures an HTTPRoute when enabled. Requires Gateway API CRDs to be installed.
tls object TLS terminates HTTPS in the Pocket-ID pod from a mounted certificate Secret.
serviceTemplate ServiceSpec ServiceTemplate is merged with the operator-built Service spec.
Operator-managed fields (the selector and the number, protocol, and appProtocol of the http/metrics ports) always take precedence.
Schemaless: {}
fileBackend string File storage backend. Automatically set to "s3" when s3 config is present.
Sets FILE_BACKEND. See https://pocket-id.org/docs/configuration/environment-variables.
s3 object S3 file backend. When present, the operator sets FILE_BACKEND=s3.
smtp object SMTP email transport. When present, the operator sets SMTP_ENABLED=true and UI_CONFIG_DISABLED=true.
emailNotifications object Email notification settings. Requires smtp. The operator sets UI_CONFIG_DISABLED=true when this section is configured.
ldap object LDAP authentication. When present, the operator sets LDAP_ENABLED=true and UI_CONFIG_DISABLED=true.
logging object Logging configuration.
tracing object OpenTelemetry tracing. When present, the operator sets OTEL_TRACES_EXPORTER=otlp.
Configure other OTEL_* variables via spec.env.
ui object UI settings. The operator sets UI_CONFIG_DISABLED=true when this section is configured.
userManagement object User registration and account settings. The operator sets UI_CONFIG_DISABLED=true when this section is configured.
webauthn object Passkey restrictions. The operator sets UI_CONFIG_DISABLED=true when this section is configured.
geoip object GeoIP/MaxMind integration for audit log geolocation.
auditLogRetentionDays integer Audit log retention in days.
Sets AUDIT_LOG_RETENTION_DAYS. See https://pocket-id.org/docs/configuration/environment-variables.
analyticsDisabled boolean Disable anonymous usage analytics.
Sets ANALYTICS_DISABLED. See https://pocket-id.org/docs/configuration/environment-variables.
versionCheckDisabled boolean Disable version checks.
Sets VERSION_CHECK_DISABLED. See https://pocket-id.org/docs/configuration/environment-variables.
rateLimitingDisabled boolean Disable rate limiting. Pocket-ID's rate limits are permissive enough for the operator, so keeping them is recommended.
Sets DISABLE_RATE_LIMITING. See https://pocket-id.org/docs/configuration/environment-variables.
internalAppUrl string Internal base URL for split-horizon DNS.
Sets INTERNAL_APP_URL. See https://pocket-id.org/docs/configuration/environment-variables.
localIPv6Ranges string Local IPv6 ranges (comma-separated CIDRs).
Sets LOCAL_IPV6_RANGES. See https://pocket-id.org/docs/configuration/environment-variables.
trustedProxies object TrustedProxies configures which proxies Pocket-ID trusts for X-Forwarded-* headers. When unset, the operator trusts the private/loopback ranges if spec.route.enabled is set.
Sets TRUST_PROXY. See https://pocket-id.org/docs/configuration/environment-variables#trust_proxy.
timezone string Timezone (e.g. "America/New_York").
Sets TZ.
cimdUrlAllowlist string array Allowed OAuth Client ID Metadata Document URLs. The operator sets UI_CONFIG_DISABLED=true when this field is set.
JSON-encoded into CIMD_URL_ALLOWLIST. See https://pocket-id.org/docs/configuration/environment-variables.
outboundAllowedHosts object Private or reserved destinations Pocket-ID may reach when fetching URLs, per feature.
OIDCClientRotation object OIDCClientRotation configures instance-wide throttling of OIDC client secret rotations.

PocketIDInstance.spec.encryptionKey

↩ PocketIDInstance.spec

SensitiveValue holds a value that can be provided as plain text or from a Kubernetes secret/configmap.

Field Type Required Default Description
value string Plain text value.
valueFrom EnvVarSource Source for the value (e.g. secretKeyRef, configMapKeyRef).

PocketIDInstance.spec.external

↩ PocketIDInstance.spec

ExternalInstanceConfig points the operator at an existing, externally-managed Pocket-ID instead of deploying one. When set, the operator creates no workload and manages OIDC clients, users, and groups on that instance via its API.

Field Type Required Default Description
url string yes URL is the base URL of the existing Pocket-ID instance (e.g. https://auth.example.com).
Pattern: ^https?://
apiKeySecretRef SecretKeySelector yes APIKeySecretRef references a Secret key holding a Pocket-ID API key with permission to manage clients, users, and groups on the instance.

PocketIDInstance.spec.databaseUrl

↩ PocketIDInstance.spec

SensitiveValue holds a value that can be provided as plain text or from a Kubernetes secret/configmap.

Field Type Required Default Description
value string Plain text value.
valueFrom EnvVarSource Source for the value (e.g. secretKeyRef, configMapKeyRef).

PocketIDInstance.spec.persistence

↩ PocketIDInstance.spec

PersistenceConfig configures persistence for the pocket-id container.

Field Type Required Default Description
enabled boolean yes false Enables mounting a persistent volume.
existingClaim string Name of an existing, externally-managed PVC to mount.
storageClass string Name of the StorageClass to provision a volume from.
size Quantity 1Gi Size of the claim to dynamically provision.
accessModes PersistentVolumeAccessMode array [ReadWriteOnce] AccessModes for the PVC.
path string /app/data Path where the data volume is mounted in the container.
subPath string SubPath within the volume to mount (volumeMount.subPath).
extraVolumeMounts VolumeMount array Extra volume mounts to add to the pocket-id container. This is useful for mounting volumes defined in spec.podTemplate.

PocketIDInstance.spec.metrics

↩ PocketIDInstance.spec

MetricsConfig configures the Prometheus metrics endpoint for Pocket-ID.

Field Type Required Default Description
enabled boolean yes false Enables the Prometheus metrics endpoint.
port integer 9464 Port for the Prometheus metrics endpoint.

PocketIDInstance.spec.route

↩ PocketIDInstance.spec

HTTPRouteConfig configures an HTTPRoute (Gateway API) for the instance. Gateway API CRDs must already be present in the cluster.

Field Type Required Default Description
enabled boolean yes false Enables creation of an HTTPRoute.
name string Name override for the HTTPRoute (defaults to the instance name).
labels object (keys:string, values:string) Additional labels for the HTTPRoute.
annotations object (keys:string, values:string) Additional annotations for the HTTPRoute.
parentRefs ParentReference array yes Gateway parent references.
MinItems: 1
hostnames Hostname array Hostnames for the route.
Automatically set to the hostname from spec.appUrl if not specified.
template HTTPRouteSpec Template is merged with the operator-built HTTPRoute spec.
Operator-managed fields (parentRefs, hostnames, and the default backend rule to the Service) always take precedence.
Schemaless: {}

PocketIDInstance.spec.tls

↩ PocketIDInstance.spec

TLSConfig terminates TLS inside the Pocket-ID pod instead of at a proxy in front of it. Pocket-ID watches the mount, so certificate renewals can be picked up without restarting the pod.

Validation rules:

  • tls.secretRef.name is required
Field Type Required Default Description
secretRef LocalObjectReference yes SecretRef names a kubernetes.io/tls Secret in the instance's namespace holding tls.crt and tls.key.

PocketIDInstance.spec.s3

↩ PocketIDInstance.spec

S3Config configures S3 as the file backend. When present, the operator sets FILE_BACKEND=s3.

Field Type Required Default Description
bucket string yes S3 bucket name.
Sets S3_BUCKET. See https://pocket-id.org/docs/configuration/environment-variables.
region string yes S3 region.
Sets S3_REGION. See https://pocket-id.org/docs/configuration/environment-variables.
endpoint string S3 endpoint URL.
Sets S3_ENDPOINT. See https://pocket-id.org/docs/configuration/environment-variables.
accessKeyId object yes S3 access key ID.
Sets S3_ACCESS_KEY_ID. See https://pocket-id.org/docs/configuration/environment-variables.
secretAccessKey object yes S3 secret access key.
Sets S3_SECRET_ACCESS_KEY. See https://pocket-id.org/docs/configuration/environment-variables.
forcePathStyle boolean Use path-style S3 URLs.
Sets S3_FORCE_PATH_STYLE. See https://pocket-id.org/docs/configuration/environment-variables.
disableDefaultIntegrityChecks boolean Disable default S3 integrity checks.
Sets S3_DISABLE_DEFAULT_INTEGRITY_CHECKS. See https://pocket-id.org/docs/configuration/environment-variables.

PocketIDInstance.spec.s3.accessKeyId

↩ PocketIDInstance.spec.s3

SensitiveValue holds a value that can be provided as plain text or from a Kubernetes secret/configmap.

Field Type Required Default Description
value string Plain text value.
valueFrom EnvVarSource Source for the value (e.g. secretKeyRef, configMapKeyRef).

PocketIDInstance.spec.s3.secretAccessKey

↩ PocketIDInstance.spec.s3

SensitiveValue holds a value that can be provided as plain text or from a Kubernetes secret/configmap.

Field Type Required Default Description
value string Plain text value.
valueFrom EnvVarSource Source for the value (e.g. secretKeyRef, configMapKeyRef).

PocketIDInstance.spec.smtp

↩ PocketIDInstance.spec

SMTPConfig configures SMTP email transport. When present, the operator sets SMTP_ENABLED=true and UI_CONFIG_DISABLED=true.

Field Type Required Default Description
host string yes SMTP server hostname.
Sets SMTP_HOST. See https://pocket-id.org/docs/configuration/environment-variables.
port integer yes SMTP server port.
Sets SMTP_PORT. See https://pocket-id.org/docs/configuration/environment-variables.
from string yes Sender email address.
Sets SMTP_FROM. See https://pocket-id.org/docs/configuration/environment-variables.
user string SMTP username.
Sets SMTP_USER. See https://pocket-id.org/docs/configuration/environment-variables.
password object SMTP password.
Sets SMTP_PASSWORD. See https://pocket-id.org/docs/configuration/environment-variables.
tls string SMTP TLS mode.
Sets SMTP_TLS. See https://pocket-id.org/docs/configuration/environment-variables.
skipCertVerify boolean Skip SMTP certificate verification.
Sets SMTP_SKIP_CERT_VERIFY. See https://pocket-id.org/docs/configuration/environment-variables.

PocketIDInstance.spec.smtp.password

↩ PocketIDInstance.spec.smtp

SensitiveValue holds a value that can be provided as plain text or from a Kubernetes secret/configmap.

Field Type Required Default Description
value string Plain text value.
valueFrom EnvVarSource Source for the value (e.g. secretKeyRef, configMapKeyRef).

PocketIDInstance.spec.emailNotifications

↩ PocketIDInstance.spec

EmailNotificationsConfig controls which email notifications Pocket-ID sends. Requires smtp. The operator sets UI_CONFIG_DISABLED=true when this section is configured.

Field Type Required Default Description
loginNotification boolean Deprecated: use loginNotificationMode instead.
loginNotificationMode string When users receive a sign-in notification email. Requires Pocket-ID v2.19.0 or newer; takes precedence over loginNotification.
Sets EMAIL_LOGIN_NOTIFICATION_MODE. See https://pocket-id.org/docs/configuration/environment-variables.
Enum: [disabled always ipAndUserAgent browserRecognition]
oneTimeAccessAsAdmin boolean Admin-sent login codes.
Sets EMAIL_ONE_TIME_ACCESS_AS_ADMIN_ENABLED. See https://pocket-id.org/docs/configuration/environment-variables.
apiKeyExpiration boolean API key expiration notifications.
Sets EMAIL_API_KEY_EXPIRATION_ENABLED. See https://pocket-id.org/docs/configuration/environment-variables.
oneTimeAccessAsUnauthenticated boolean Email login codes for unauthenticated users.
Sets EMAIL_ONE_TIME_ACCESS_AS_UNAUTHENTICATED_ENABLED. See https://pocket-id.org/docs/configuration/environment-variables.
verification boolean Deprecated: use verificationMode instead.
verificationMode string Email verification mode. Requires Pocket-ID v2.19.0 or newer; takes precedence over verification.
With required, non-admin users (including operator-managed ones) must verify their email before using Pocket-ID.
Sets EMAIL_VERIFICATION. See https://pocket-id.org/docs/configuration/environment-variables.
Enum: [disabled optional required]

PocketIDInstance.spec.ldap

↩ PocketIDInstance.spec

LDAPConfig configures LDAP authentication. When present, the operator sets LDAP_ENABLED=true and UI_CONFIG_DISABLED=true.

Field Type Required Default Description
url string yes LDAP server URL.
Sets LDAP_URL. See https://pocket-id.org/docs/configuration/environment-variables.
bindDN string yes Bind DN.
Sets LDAP_BIND_DN. See https://pocket-id.org/docs/configuration/environment-variables.
bindPassword object yes Bind password.
Sets LDAP_BIND_PASSWORD. See https://pocket-id.org/docs/configuration/environment-variables.
base string yes Search base DN.
Sets LDAP_BASE. See https://pocket-id.org/docs/configuration/environment-variables.
skipCertVerify boolean Skip LDAP certificate verification.
Sets LDAP_SKIP_CERT_VERIFY. See https://pocket-id.org/docs/configuration/environment-variables.
softDeleteUsers boolean Disable removed users instead of deleting them.
Sets LDAP_SOFT_DELETE_USERS. See https://pocket-id.org/docs/configuration/environment-variables.
adminGroupName string Group that grants admin privileges.
Sets LDAP_ADMIN_GROUP_NAME. See https://pocket-id.org/docs/configuration/environment-variables.
userSearchFilter string User search filter.
Sets LDAP_USER_SEARCH_FILTER. See https://pocket-id.org/docs/configuration/environment-variables.
userGroupSearchFilter string Group search filter.
Sets LDAP_USER_GROUP_SEARCH_FILTER. See https://pocket-id.org/docs/configuration/environment-variables.
attributeMapping object LDAP attribute mappings.

PocketIDInstance.spec.ldap.bindPassword

↩ PocketIDInstance.spec.ldap

SensitiveValue holds a value that can be provided as plain text or from a Kubernetes secret/configmap.

Field Type Required Default Description
value string Plain text value.
valueFrom EnvVarSource Source for the value (e.g. secretKeyRef, configMapKeyRef).

PocketIDInstance.spec.ldap.attributeMapping

↩ PocketIDInstance.spec.ldap

LDAPAttributeMappingConfig maps LDAP attributes to Pocket-ID user/group fields.

Field Type Required Default Description
userUniqueIdentifier string User unique identifier attribute.
Sets LDAP_ATTRIBUTE_USER_UNIQUE_IDENTIFIER. See https://pocket-id.org/docs/configuration/environment-variables.
userUsername string Username attribute.
Sets LDAP_ATTRIBUTE_USER_USERNAME. See https://pocket-id.org/docs/configuration/environment-variables.
userEmail string Email attribute.
Sets LDAP_ATTRIBUTE_USER_EMAIL. See https://pocket-id.org/docs/configuration/environment-variables.
userFirstName string First name attribute.
Sets LDAP_ATTRIBUTE_USER_FIRST_NAME. See https://pocket-id.org/docs/configuration/environment-variables.
userLastName string Last name attribute.
Sets LDAP_ATTRIBUTE_USER_LAST_NAME. See https://pocket-id.org/docs/configuration/environment-variables.
userDisplayName string Display name attribute.
Sets LDAP_ATTRIBUTE_USER_DISPLAY_NAME. See https://pocket-id.org/docs/configuration/environment-variables.
userProfilePicture string Profile picture attribute.
Sets LDAP_ATTRIBUTE_USER_PROFILE_PICTURE. See https://pocket-id.org/docs/configuration/environment-variables.
groupMember string Group membership attribute.
Sets LDAP_ATTRIBUTE_GROUP_MEMBER. See https://pocket-id.org/docs/configuration/environment-variables.
groupUniqueIdentifier string Group unique identifier attribute.
Sets LDAP_ATTRIBUTE_GROUP_UNIQUE_IDENTIFIER. See https://pocket-id.org/docs/configuration/environment-variables.
groupName string Group name attribute.
Sets LDAP_ATTRIBUTE_GROUP_NAME. See https://pocket-id.org/docs/configuration/environment-variables.

PocketIDInstance.spec.logging

↩ PocketIDInstance.spec

LoggingConfig configures logging behavior.

Field Type Required Default Description
level string Log level.
Sets LOG_LEVEL. See https://pocket-id.org/docs/configuration/environment-variables.
json boolean JSON log output.
Sets LOG_JSON. See https://pocket-id.org/docs/configuration/environment-variables.
queryArgs boolean Include SQL query arguments in debug logs and traces.
Sets LOG_QUERY_ARGS. See https://pocket-id.org/docs/configuration/environment-variables.

PocketIDInstance.spec.tracing

↩ PocketIDInstance.spec

TracingConfig enables OpenTelemetry tracing. When present, the operator sets OTEL_TRACES_EXPORTER=otlp. Configure other OTEL_* variables via spec.env.

Field Type Required Default Description
endpoint string OTLP traces endpoint, including the path.
Sets OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. See https://pocket-id.org/docs/configuration/environment-variables.

PocketIDInstance.spec.ui

↩ PocketIDInstance.spec

UIConfig configures Pocket-ID UI settings. The operator sets UI_CONFIG_DISABLED=true when this section is configured.

Field Type Required Default Description
appName string Application name.
Sets APP_NAME. See https://pocket-id.org/docs/configuration/environment-variables.
sessionDuration integer Session duration in minutes.
Sets SESSION_DURATION. See https://pocket-id.org/docs/configuration/environment-variables.
homePageUrl string Post-login redirect page.
Sets HOME_PAGE_URL. See https://pocket-id.org/docs/configuration/environment-variables.
disableAnimations boolean Disable UI animations.
Sets DISABLE_ANIMATIONS. See https://pocket-id.org/docs/configuration/environment-variables.
accentColor string UI accent color.
Sets ACCENT_COLOR. See https://pocket-id.org/docs/configuration/environment-variables.

PocketIDInstance.spec.userManagement

↩ PocketIDInstance.spec

UserManagementConfig configures user registration and account settings. The operator sets UI_CONFIG_DISABLED=true when this section is configured.

Field Type Required Default Description
emailsVerified boolean Mark emails as verified.
Sets EMAILS_VERIFIED. See https://pocket-id.org/docs/configuration/environment-variables.
allowOwnAccountEdit boolean Allow users to edit their own account.
Sets ALLOW_OWN_ACCOUNT_EDIT. See https://pocket-id.org/docs/configuration/environment-variables.
requireUserEmail boolean Require an email address.
Sets REQUIRE_USER_EMAIL. See https://pocket-id.org/docs/configuration/environment-variables.
allowUserSignups string User signup mode.
Sets ALLOW_USER_SIGNUPS. See https://pocket-id.org/docs/configuration/environment-variables.
signupDefaultCustomClaims string Default custom claims for new users.
Sets SIGNUP_DEFAULT_CUSTOM_CLAIMS. See https://pocket-id.org/docs/configuration/environment-variables.
signupDefaultUserGroupIds string array Default user group IDs for new users.
JSON-encoded into SIGNUP_DEFAULT_USER_GROUP_IDS. See https://pocket-id.org/docs/configuration/environment-variables.

PocketIDInstance.spec.webauthn

↩ PocketIDInstance.spec

WebAuthnConfig restricts which passkeys Pocket-ID accepts. The operator sets UI_CONFIG_DISABLED=true when this section is configured.

Field Type Required Default Description
userVerification string Passkey user verification requirement.
Sets WEBAUTHN_USER_VERIFICATION. See https://pocket-id.org/docs/configuration/environment-variables.
allowSyncedPasskeys boolean Allow synced passkeys.
Sets WEBAUTHN_ALLOW_SYNCED_PASSKEYS. See https://pocket-id.org/docs/configuration/environment-variables.
authenticatorAttachment string Accepted authenticator type.
Sets WEBAUTHN_AUTHENTICATOR_ATTACHMENT. See https://pocket-id.org/docs/configuration/environment-variables.

PocketIDInstance.spec.geoip

↩ PocketIDInstance.spec

GeoIPConfig configures GeoIP/MaxMind integration for audit log geolocation.

Field Type Required Default Description
maxmindLicenseKey object MaxMind license key.
Sets MAXMIND_LICENSE_KEY. See https://pocket-id.org/docs/configuration/environment-variables.
dbPath string GeoLite2 database path.
Sets GEOLITE_DB_PATH. See https://pocket-id.org/docs/configuration/environment-variables.
dbUrl object GeoLite2 database download URL.
Sets GEOLITE_DB_URL. See https://pocket-id.org/docs/configuration/environment-variables.

PocketIDInstance.spec.geoip.maxmindLicenseKey

↩ PocketIDInstance.spec.geoip

SensitiveValue holds a value that can be provided as plain text or from a Kubernetes secret/configmap.

Field Type Required Default Description
value string Plain text value.
valueFrom EnvVarSource Source for the value (e.g. secretKeyRef, configMapKeyRef).

PocketIDInstance.spec.geoip.dbUrl

↩ PocketIDInstance.spec.geoip

SensitiveValue holds a value that can be provided as plain text or from a Kubernetes secret/configmap.

Field Type Required Default Description
value string Plain text value.
valueFrom EnvVarSource Source for the value (e.g. secretKeyRef, configMapKeyRef).

PocketIDInstance.spec.trustedProxies

↩ PocketIDInstance.spec

TrustedProxiesConfig configures which upstream proxies Pocket-ID trusts for X-Forwarded-* headers (the TRUST_PROXY environment variable). This determines the client IP Pocket-ID sees, which feeds rate limiting, audit-log IPs, and GeoIP. When this section is omitted, the operator sets TRUST_PROXY=false unless it manages the instance's route (spec.route.enabled), in which case it trusts the private/loopback ranges where a Gateway's IP would be.

Field Type Required Default Description
enabled boolean yes false Enabled turns on trust of X-Forwarded-* headers. When false, TRUST_PROXY is set to "false".
cidrs string array CIDRs is the list of trusted proxy IPs/CIDRs. Only used when enabled is true. When empty, TRUST_PROXY is set to "true", trusting all upstream sources.
To restrict trust, list explicit ranges, e.g. the cluster pod network or a CDN's published ranges when it connects directly to the pod.

PocketIDInstance.spec.outboundAllowedHosts

↩ PocketIDInstance.spec

OutboundAllowedHostsConfig lists the private or reserved destinations Pocket-ID may reach when fetching URLs for each feature. Requires Pocket-ID v2.19.0 or newer. Entries are IP addresses, CIDR ranges, hostnames ("*.example.com" matches subdomains) or the keywords "private", "loopback" and "none". An unset field keeps Pocket-ID's default; use ["none"] to block every private destination.

Field Type Required Default Description
clientLogo string array Client logo downloads. The icon library host is always allowed.
Sets OUTBOUND_ALLOWED_HOSTS_CLIENT_LOGO. See https://pocket-id.org/docs/configuration/environment-variables.
clientMetadata string array OAuth Client ID Metadata Document fetches.
Sets OUTBOUND_ALLOWED_HOSTS_CLIENT_METADATA. See https://pocket-id.org/docs/configuration/environment-variables.
scim string array SCIM provisioning requests. Pocket-ID defaults to private,loopback.
Sets OUTBOUND_ALLOWED_HOSTS_SCIM. See https://pocket-id.org/docs/configuration/environment-variables.
backchannelLogout string array Back-channel logout requests. Pocket-ID defaults to private,loopback.
Sets OUTBOUND_ALLOWED_HOSTS_BACKCHANNEL_LOGOUT. See https://pocket-id.org/docs/configuration/environment-variables.
federatedJwks string array Federated identity JWKS fetches. Pocket-ID defaults to private,loopback.
Sets OUTBOUND_ALLOWED_HOSTS_FEDERATED_JWKS. See https://pocket-id.org/docs/configuration/environment-variables.
ldapPicture string array LDAP profile picture downloads.
Sets OUTBOUND_ALLOWED_HOSTS_LDAP_PICTURE. See https://pocket-id.org/docs/configuration/environment-variables.

PocketIDInstance.spec.OIDCClientRotation

↩ PocketIDInstance.spec

OIDCClientRotationConfig controls instance-wide throttling of OIDC client secret rotations.

Field Type Required Default Description
minSpacing Duration yes MinSpacing is the minimum time between any two client secret rotations on this instance.
Prevents a thundering herd when many clients become due simultaneously.

PocketIDInstance.status

PocketIDInstanceStatus defines the observed state of PocketIDInstance.

Field Type Required Default Description
version string Version is the current deployed version of the Pocket-ID instance, retrieved from the /api/version/current endpoint.
staticApiKeySecretName string StaticAPIKeySecretName is the name of the Secret containing the STATIC_API_KEY.
conditions Condition array Conditions represent the current state of the Instance resource.
lastRotatedClientSecret Time LastRotatedClientSecret is the timestamp of the most recent OIDC client secret rotation on this instance.
Used to enforce spec.OIDCClientRotation.minSpacing.