Custom Resources Overview

All resources belong to the API group core.navique.com, version v1alpha1. This page is the map; each resource has its own reference page with full fields, defaults, status, and examples.

The resource map

Resource	Scope	Role
License	Cluster	Singleton signed offline license; gates features and instance caps
SecretsManagement	Namespaced	Required. Credential backend — ESO or Sealed Secrets
PostgresCluster	Namespaced	Shared PostgreSQL, multi-database
ClickHouseCluster	Namespaced	ClickHouse
RedisInstance	Namespaced	Redis
MongoCluster	Namespaced	Shared MongoDB, multi-database
MeilisearchInstance	Namespaced	Meilisearch search backend
Gateway	Namespaced	AI gateway (LiteLLM or Wäg, via spec.type) + models / teams / orgs
Observability	Namespaced	LLM observability (Langfuse v3)
ChatUI	Namespaced	LibreChat UI, wired to a Gateway
ManagementPlane	Namespaced	Configures the admin console (deployed by default)
Stack	Namespaced	Optional umbrella — curated, auto-wired bundle (licensed)
User	Namespaced	A person / licensed seat (counts against the users cap)
Identity / Organization / Team	Namespaced	Managed per-backend accounts and tenancy (licensed)
Lock	Namespaced	Protects a resource from accidental deletion (Azure-style lock)
ServiceMesh	Cluster	Installs/adopts Istio (Sail) for mTLS + tenant isolation (licensed)

Conventions used across every resource

These hold for every resource unless a page says otherwise.

secretsRef (optional on workloads)

Every workload (Gateway, Observability, ChatUI) references each credential it needs directly — an admin account Secret, a keys Secret, a connection Secret. secretsRef optionally names a same-namespace SecretsManagement that produces those Secrets (ESO from a vault, or SealedSecrets); the workload then waits until it is Ready.

Leave secretsRef out to run a workload on plain Kubernetes Secrets you create yourself — no ESO or SealedSecrets needed. A Stack sets it only when it has a spec.secrets backend.

Databases for workloads that reference a datastore

A workload that references a shared managed datastore needs its own database there: an Observability on a PostgresCluster (langfuse.postgres.databaseName) and a ClickHouseCluster (langfuse.clickhouse.databaseName), a Gateway on a PostgresCluster (database.databaseName, default litellm) and — for Wäg in split storage — a ClickHouseCluster (waeg.clickhouseDatabase, default waeg), a ChatUI on a MongoCluster (mongo.databaseName, default LibreChat).

• With the auto-wiring licence the datastore finds these references and creates the databases itself, next to the ones its spec.databases declares. Its spec is never edited (a GitOps tool has nothing to revert); each database in status.databases lists the workloads using it in claimedBy. The workload's connection Secret is created and mounted as usual.
• Without it, declare the database in the datastore's spec.databases. Until you do, the workload's DatastoreReady condition names the exact entry to add.

A database is never dropped when its workload goes away: the data outlives a mistaken delete. A Stack declares its own databases, so it works either way.

Reference shapes

Type	Shape	Notes
ObjectRef	{ name, namespace? }	Namespace defaults to the resource's own; cross-namespace allowed for datastores / gateways / observability
LocalRef	{ name }	Same-namespace only (secretsRef)
SecretKeyRef	{ name, key?, namespace? }	Secret references stay in-namespace

Status and conditions

Every resource exposes status.conditions []metav1.Condition with at least a Ready condition plus per-phase conditions, and an observedGeneration. Recommended kubectl get print columns surface phase/Ready, mode/type, and a meaningful endpoint or count per resource.

Datastore type × mode

The five datastore resources share the same shape: a type (backend implementation) and a mode (provenance — managed / adopt / external). See Core Concepts.

How they compose

Resources cross-reference each other to form the platform:

ChatUI ──gatewayRef──▶ Gateway ──observabilityRef──▶ Observability
  │                       │                              │
  ├─mongo──▶ MongoCluster │                              ├─postgres──▶ PostgresCluster
  └─meili──▶ Meilisearch  └─database──▶ PostgresCluster  ├─clickhouse▶ ClickHouseCluster
                                                         └─redis─────▶ RedisInstance

All workloads ──secretsRef (optional)──▶ SecretsManagement (same namespace)
License (cluster) ──gates──▶ every controller's feature flags + instance caps

References can cross namespaces (except Secret references, which stay in-namespace), and several workloads can share one datastore or one Observability.