API Reference

API Reference

API Reference

Packages

argocd-service.vsphere.vmware.com/v1alpha1

Package v1alpha1 contains API Schema definitions for the argocd-service v1alpha1 API group.

Resource Types

ArgoCD

ArgoCD is the Schema for the ArgoCD API. It represents a complete ArgoCD installation in a Kubernetes cluster.

Field Description Default Validation

apiVersion string

argocd-service.vsphere.vmware.com/v1alpha1

kind string

ArgoCD

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec ArgoCDSpec

spec defines the desired state of the ArgoCD deployment.

status ArgoCDStatus

status defines the observed state of the ArgoCD deployment.

ArgoCDApplicationController

ArgoCDApplicationController configures the argocd-application-controller statefulset, which continuously monitors applications and synchronizes the desired state.

Appears In:
Field Description Default Validation

replicas integer

replicas specifies the number of argocd-application-controller pod replicas.
If not specified, defaults to 1.

proxy ArgoCDProxy

proxy specifies the proxy configuration for the component.

resources ResourceRequirements

resources specifies the compute resources (CPU, memory) required by argocd-application-controller pods.

ArgoCDApplicationSetController

ArgoCDApplicationSetController configures the argocd-applicationset-controller deployment, which provides support for ApplicationSet resources.

Appears In:
Field Description Default Validation

enabled boolean

enabled enables the ApplicationSet controller.
When false, the ApplicationSet controller will not be deployed.

replicas integer

replicas specifies the number of argocd-applicationset-controller pod replicas.
If not specified, defaults to 1.

proxy ArgoCDProxy

proxy specifies the proxy configuration for the component.

resources ResourceRequirements

resources specifies the compute resources (CPU, memory) required by argocd-applicationset-controller pods.

ArgoCDConfig

Appears In:
Field Description Default Validation

secretLabels object (keys:string, values:string)

secretLabels specifies additional labels to apply to the ArgoCD cluster secret.

secretAnnotations object (keys:string, values:string)

secretAnnotations specifies additional annotations to apply to the ArgoCD cluster secret.

argoCDProject string

argoCDProject is the ArgoCD AppProject to associate with.
Same usage as https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters

proxy string

proxy specifies an HTTP/HTTPS proxy URL for cluster communication.
Same usage as https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters

disableCompression boolean

disableCompression disables automatic compression for requests to the cluster.
This can be useful for clusters with limited bandwidth or high latency connections.
Same usage as https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters

ArgoCDControlledResources

ArgoCDControlledResources defines resource filters by ApiGroups, Kinds, and Clusters. This aligns with upstream ArgoCD’s Resource Exclusion/Inclusion patterns.

Appears In:
Field Description Default Validation

apiGroups string array

apiGroups specifies the list of Kubernetes API groups to match.
Example: ["apps", "batch"]

kinds string array

kinds specifies the list of Kubernetes resource kinds to match.
Example: ["Deployment", "StatefulSet", "Job"]

clusters string array

clusters specifies the list of cluster names where this filter applies.
If empty, the filter applies to all clusters.

ArgoCDNotification

ArgoCDNotification configures the argocd-notifications-controller deployment, which sends event notifications via webhooks, email, Slack, etc.

Appears In:
Field Description Default Validation

enabled boolean

enabled enables the Notifications controller.
When false, the Notifications controller will not be deployed.

replicas integer

replicas specifies the number of argocd-notifications-controller pod replicas.
If not specified, defaults to 1.

proxy ArgoCDProxy

proxy specifies the proxy configuration for the component.

resources ResourceRequirements

resources specifies the compute resources (CPU, memory) required by argocd-notifications-controller pods.

ArgoCDOIDC

ArgoCDOIDC configures OpenID Connect (OIDC) authentication for ArgoCD. The fields map to the keys under the oidc.config field in the argocd-cm ConfigMap. Reference https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#oidc-authentication

Example:

oidc:
  enabled: true
  name: "VCFA"
  issuer: "https://vcfa.example.com/oidc"
  clientID: "argocd-client"
  requestedScopes:
    - openid
    - profile
    - email
    - groups
Appears In:
Field Description Default Validation

enabled boolean

enabled enables OIDC authentication for ArgoCD.
When true, users can authenticate using the configured OIDC provider.

name string

name specifies the display name for this OIDC provider configuration.

MinLength: 1

issuer string

issuer specifies the OIDC provider URL.
Example: "https://vcfa.*.com/oidc"

MinLength: 1

clientID string

clientID specifies the OAuth2 client ID registered with the OIDC provider.
This is obtained when registering ArgoCD as an application with your identity provider.

MinLength: 1

clientSecret string

clientSecret specifies the OAuth2 client secret paired with ClientID.
This secret must be kept confidential and is used to authenticate ArgoCD with the OIDC provider.

MinLength: 1

requestedScopes string array

requestedScopes specifies the OAuth2 scopes to request from the OIDC provider.
Common scopes include "openid", "profile", "email", and "groups".
Example: ["openid", "profile", "email", "groups"]

allowedAudiences string array

allowedAudiences specifies the list of valid audiences ("aud" claim) for JWT tokens.
If specified, tokens must contain one of these audience values to be accepted.

requestedIDTokenClaims KeyValues

requestedIDTokenClaims specifies additional claims to request in the OIDC ID token.
This is a map of claim names to their request parameters.

cliClientID string

cliClientID specifies the OAuth2 client ID for ArgoCD CLI authentication.
If not specified, the main ClientID is used for both UI and CLI authentication.

MinLength: 1

enablePKCEAuthentication boolean

enablePKCEAuthentication enables Proof Key for Code Exchange (PKCE) for the OAuth2 flow.
PKCE provides additional security for public clients like the ArgoCD CLI.

skipAudienceCheckWhenTokenHasNoAudience boolean

skipAudienceCheckWhenTokenHasNoAudience skips audience validation when the JWT token
does not contain an "aud" claim. Use with caution in development environments only.

insecure boolean

insecure disables TLS certificate validation for the OIDC provider.
This should only be used in development environments with self-signed certificates.
Not recommended for production use.

ca string

ca is the PEM certificate used to validate the OIDC identity provider’s TLS certificate.
This may contain a single root CA or a full certificate chain, depending on the OIDC provider’s certificate configuration.
Must be a base64-encoded PEM-encoded certificate

MinLength: 1

ArgoCDProxy

ArgoCDProxy configures the proxy settings for an ArgoCD component.

Appears In:
Field Description Default Validation

httpProxy string

httpProxy specifies the HTTP proxy URL.
Example: "http://proxy.example.com:8080"

httpsProxy string

httpsProxy specifies the HTTPS proxy URL.
Example: "https://proxy.example.com:8080"

noProxy string

noProxy specifies a comma-separated list of domains/IPs to bypass the proxy.
Example: "localhost,127.0.0.1,.svc.cluster.local"

ArgoCDRBAC

ArgoCDRBAC configures role-based access control (RBAC) policies for ArgoCD, including default policies, custom rules, and OIDC group mappings. The fields map to the fields in the argocd-rbac-cm.yml. Reference https://argo-cd.readthedocs.io/en/latest/operator-manual/argocd-rbac-cm-yaml/

Example:

rbac:
  defaultPolicy: "role:readonly"
  policy: |
    p, role:devops, applications, *, */*, allow
    p, role:devops, clusters, get, *, allow
    g, Alice, role:devops
    g, Bob, role:admin
Appears In:
Field Description Default Validation

defaultPolicy string

defaultPolicy specifies the default role that ArgoCD falls back to when authorizing API requests.
Common values: "role:readonly" or "role:admin"

policy string

policy defines user-defined RBAC policies and role definitions in CSV format.
Policy rules are in the form: p, subject, resource, action, object, effect
Role definitions and bindings are in the form: g, subject, inherited-subject
See https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/rbac.md for additional information.

MinLength: 1

scopes string

scopes specifies which ID token claims ArgoCD examines during RBAC enforcement.

MinLength: 1

policyMatchMode string

policyMatchMode configures the pattern matching mode for Casbin policies.
Valid values: "glob" for glob pattern matching, "regex" for regex pattern matching.

glob

Enum: [glob regex]
MinLength: 1

ArgoCDRedis

ArgoCDRedis configures the argocd-redis cache deployment, which provides caching and temporary data storage. The underlying engine is Valkey (Redis-compatible drop-in). Names stay redis/argocd-redis for upstream Argo CD binary compatibility.

Appears In:
Field Description Default Validation

resources ResourceRequirements

resources specifies the compute resources (CPU, memory, ephemeral-storage)
required by the argocd-redis cache pod.

ArgoCDRepo

ArgoCDRepo configures the argocd-repo-server deployment, which handles repository operations.

Appears In:
Field Description Default Validation

replicas integer

replicas specifies the number of argocd-repo-server pod replicas.
Higher replica counts improve repository operation throughput.
If not specified, defaults to 1.

proxy ArgoCDProxy

proxy specifies the proxy configuration for the component.

resources ResourceRequirements

resources specifies the compute resources (CPU, memory) required by argocd-repo-server pods.

ArgoCDResourceConfig

ArgoCDResourceConfig configures which Kubernetes resources ArgoCD can discover and synchronize. Example:

resourceConfig:
  inclusions:
    - apiGroups:
        - "apps"
      kinds:
        - "Deployment"
        - "StatefulSet"
      clusters:
        - "prod-cluster"
    - apiGroups:
        - "cluster.x-k8s.io"
      kinds:
        - "*"
      clusters:
        - "https://172.16.0.200:443"
  exclusions:
    - apiGroups:
        - ""
      kinds:
        - "Secret"

if inclusions field is not specified, that means all resource groups and kinds are included for ArgoCD to discover and sync.

If exclusions field is not specified, the following API groups and resources are excluded by default in the argocd-cm ConfigMap:

resource.exclusions: |
  - apiGroups:
      - ""
      - discovery.k8s.io
    kinds:
      - EndpointSlice
      - Endpoints
  - apiGroups:
      - ""
      - events.k8s.io
    kinds:
      - Event
  - apiGroups:
      - acme.cert-manager.io
    kinds:
      - Challenge
      - Order
  - apiGroups:
      - appplatform.vmware.com
  - apiGroups:
      - appplatform.wcp.vmware.com
  - apiGroups:
      - authentication.k8s.io
      - authorization.k8s.io
    kinds:
      - SelfSubjectReview
      - TokenReview
      - LocalSubjectAccessReview
      - SelfSubjectAccessReview
      - SelfSubjectRulesReview
      - SubjectAccessReview
  - apiGroups:
      - bootstrap.cluster.x-k8s.io
  - apiGroups:
      - cert-manager.io
    kinds:
      - CertificateRequest
  - apiGroups:
      - certificates.k8s.io
    kinds:
      - CertificateSigningRequest
  - apiGroups:
      - cilium.io
    kinds:
      - CiliumIdentity
      - CiliumEndpoint
      - CiliumEndpointSlice
  - apiGroups:
      - cli.tanzu.vmware.com
  - apiGroups:
      - cli.vmware.com
  - apiGroups:
      - clientsecret.supervisor.pinniped.dev
  - apiGroups:
      - cni.kubernetes.vmware.com
  - apiGroups:
      - cns.vmware.com
  - apiGroups:
      - config.supervisor.pinniped.dev
  - apiGroups:
      - config.vcf.vmware.com
  - apiGroups:
      - coordination.k8s.io
    kinds:
      - Lease
  - apiGroups:
      - crd.nsx.vmware.com
  - apiGroups:
      - encryption.vmware.com
  - apiGroups:
      - groupsnapshot.storage.k8s.io
    kinds:
      - VolumeGroupSnapshot
  - apiGroups:
      - iaas.vmware.com
  - apiGroups:
      - idp.supervisor.pinniped.dev
  - apiGroups:
      - imagecontroller.vmware.com
  - apiGroups:
      - imageregistry.vmware.com
  - apiGroups:
      - infra.vmware.com
  - apiGroups:
      - infrastructure.cluster.vmware.com
  - apiGroups:
      - installers.tmc.cloud.vmware.com
  - apiGroups:
      - internal.packaging.carvel.dev
  - apiGroups:
      - kyverno.io
      - reports.kyverno.io
      - wgpolicyk8s.io
    kinds:
      - PolicyReport
      - ClusterPolicyReport
      - EphemeralReport
      - ClusterEphemeralReport
      - AdmissionReport
      - ClusterAdmissionReport
      - BackgroundScanReport
      - ClusterBackgroundScanReport
      - UpdateRequest
  - apiGroups:
      - mobility-operator.vmware.com
  - apiGroups:
      - netoperator.vmware.com
  - apiGroups:
      - nsx.vmware.com
  - apiGroups:
      - os.kubernetes.vmware.com
  - apiGroups:
      - psp.wcp.vmware.com
  - apiGroups:
      - rbac.iaas.vmware.com
  - apiGroups:
      - run.tanzu.vmware.com
  - apiGroups:
      - snapshot.storage.k8s.io
    kinds:
      - VolumeSnapshot
  - apiGroups:
      - storage.k8s.io
    kinds:
      - CSIStorageCapacity
  - apiGroups:
      - topology.tanzu.vmware.com
  - apiGroups:
      - veleroappoperator.vmware.com
  - apiGroups:
      - vmware.infrastructure.cluster.x-k8s.io
Appears In:
Field Description Default Validation

inclusions ArgoCDControlledResources array

inclusions defines the resources that ArgoCD should discover and sync.
Only resources matching these filters will be managed by ArgoCD.

exclusions ArgoCDControlledResources array

exclusions defines the resources that ArgoCD should not discover and sync.
Resources matching these filters will be ignored even if they match inclusions.

ArgoCDServer

ArgoCDServer configures the argocd-server deployment, which provides the API server and web UI.

Example:

server:
  replicas: 2
  resources:
    requests:
      cpu: "500m"
      memory: "512Mi"
    limits:
      cpu: "2000m"
      memory: "2Gi"
  proxy:
    httpProxy: "http://proxy.example.com:8080"
    httpsProxy: "https://proxy.example.com:8080"
    noProxy: "localhost,127.0.0.1,.svc.cluster.local,.svc,argocd-server,argocd-repo-server,argocd-redis"
  tlsCert:
    secretRef:
      name: "argocd-server-customized-tls"
      namespace: "argocd-instance-ns"
Appears In:
Field Description Default Validation

replicas integer

replicas specifies the number of argocd-server pod replicas.
Higher replica counts provide high availability for the UI and API.
If not specified, defaults to 1.

proxy ArgoCDProxy

proxy specifies the proxy configuration for the component.

resources ResourceRequirements

resources specifies the compute resources (CPU, memory) required by argocd-server pods.

tlsCert TLSCert

tlsCert specifies the TLS certificate configuration provided by the user for HTTPS.
If not specified, ArgoCD will generate a self-signed certificate.

ArgoCDServiceAccountsStatus

ArgoCDServiceAccountsStatus records the service accounts created for the ArgoCD deployment.

Appears In:
Field Description Default Validation

platform PlatformServiceAccountStatus

platform records the auto-created VCF Automation service account.

supervisor SupervisorServiceAccountStatus

supervisor records the auto-created K8S service account.

ArgoCDSpec

ArgoCDSpec defines the desired configuration for an ArgoCD deployment, including version, authentication, RBAC, and component settings.

Appears In:
Field Description Default Validation

paused boolean

paused indicates that reconciliation for this resource is stopped.
This is useful for debugging or maintenance purposes.

version string

version specifies the ArgoCD Carvel Package version to deploy.
The version must follow the pattern: X.Y.Z+vmware.W-vks.V

MinLength: 1
Pattern: ^(\d+)\.(\d+)\.(\d+)\+vmware\.(\d+)-vks\.(\d+)$

enableLoadBalancer boolean

enableLoadBalancer creates a LoadBalancer service for the ArgoCD Server.
When enabled, the ArgoCD UI will be accessible via an external load balancer.

true

url string

url specifies the external URL for the ArgoCD Server.
This field is required when OIDC authentication is enabled.
Example: "https://argocd.example.com"

MinLength: 1
Pattern: ^http(s)?://

serverSideDiff boolean

serverSideDiff enables server-side diff for all ArgoCD applications.
When enabled, resource diffs are calculated on the server side for better performance.

true

localAccounts string array

localAccounts defines the list of local user account names for ArgoCD authentication.
These accounts can be used to log in to ArgoCD in addition to SSO/OIDC.
Example: ["Alice", "Bob"]

oidc ArgoCDOIDC

oidc configures OpenID Connect authentication for ArgoCD.

rbac ArgoCDRBAC

rbac configures global role-based access control policies for ArgoCD.

resourceConfig ArgoCDResourceConfig

resourceConfig defines which Kubernetes resources ArgoCD can discover and sync.

resourceHealthChecks ResourceHealthCheck array

resourceHealthChecks defines custom Lua health check scripts for specific Kubernetes resources.

server ArgoCDServer

server configures the argocd-server deployment (UI and API server).

repo ArgoCDRepo

repo configures the argocd-repo-server deployment (repository operations).

controller ArgoCDApplicationController

controller configures the argocd-application-controller statefulset (application reconciliation).

applicationSet ArgoCDApplicationSetController

applicationSet configures the argocd-applicationset-controller deployment (ApplicationSet support).

redis ArgoCDRedis

redis configures the argocd-redis cache deployment.
The cache is Valkey-backed (Redis-compatible drop-in).

notification ArgoCDNotification

notification configures the argocd-notifications-controller deployment (event notifications).

ArgoCDStatus

ArgoCDStatus records the observed state of an ArgoCD deployment.

Appears In:
Field Description Default Validation

conditions Condition array

conditions records the current service state of the ArgoCD deployment.

MaxItems: 32

observedGeneration integer

observedGeneration is the metadata.generation of the resource that was last reconciled.

phase string

phase records the current operational phase of the ArgoCD deployment.

MinLength: 1

serviceAccounts ArgoCDServiceAccountsStatus

serviceAccounts records the service accounts created for the ArgoCD deployment.

oidcConfig VCFAOIDCConfigStatus

oidcConfig records the configuration of the OIDC RelyingParty created in the VCF Automation tenant portal.

externalIP string

externalIP records the external IP of the LoadBalancer service for the ArgoCD Server.

MinLength: 1

ArgoCDVersion

ArgoCDVersion is the Schema for the ArgoCDVersion API This is a cluster-scoped resource that maintains the list of supported ArgoCD versions. This resource is automatically managed by the argocd-service operator and provides read-only access to end users to query available versions.

Field Description Default Validation

apiVersion string

argocd-service.vsphere.vmware.com/v1alpha1

kind string

ArgoCDVersion

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec ArgoCDVersionSpec

spec defines the supported versions of ArgoCD

ArgoCDVersionInfo

ArgoCDVersionInfo contains information about a specific ArgoCD version

Appears In:
Field Description Default Validation

version string

version defines the supported ArgoCD version string

MinLength: 1
Pattern: ^(\d+)\.(\d+)\.(\d+)\+vmware\.(\d+)-vks\.(\d+)$

description string

description specifies an additional information about this version

MaxLength: 512
MinLength: 1

ArgoCDVersionSpec

ArgoCDVersionSpec defines the desired state of ArgoCDVersion

Appears In:
Field Description Default Validation

versions ArgoCDVersionInfo array

versions defines the list of supported ArgoCD versions

MinItems: 1

CELSelector

Appears In:
Field Description Default Validation

matchExpressions string array

matchExpressions is a list of CEL match expressions.

Decision

Appears In:
Field Description Default Validation

apiGroup string

apiGroup specifies the API group of the target resource.
Use an empty string "" for a Supervisor Namespace, or "cluster.x-k8s.io" for a VKS cluster.

kind string

kind specifies the schema kind of the target resource.
Supported values are "Namespace" (for a Supervisor Namespace) or "Cluster" (for a VKS cluster).

name string

name specifies the resource name of the target Supervisor Namespace or VKS cluster.

namespace string

namespace specifies the vSphere namespace where the target VKS cluster resides.
This field is required for VKS clusters (kind="Cluster") and must be empty or omitted for Supervisor Namespaces (kind="Namespace").

project string

project specifies the VCF Automation (VCF-A) project name that the target resource belongs to.
This field is required when operating under VCF Automation scope, and must be empty or omitted when operating under direct native Supervisor scope.

outcome string

outcome indicates whether the target is eligible and managed by the policy.

MinLength: 1

reason string

reason explains the outcome.

MinLength: 1

time Time

time records the time when the decision is made.

EntityManagementPolicy

EntityManagementPolicy is the Schema for the EntityManagementPolicies API.

Field Description Default Validation

apiVersion string

argocd-service.vsphere.vmware.com/v1alpha1

kind string

EntityManagementPolicy

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec EntityManagementPolicySpec

spec defines the desired state of the entity management policy.

status EntityManagementPolicyStatus

status defines the observed state of the entity management policy.

EntityManagementPolicyRule

EntityManagementPolicyRule is a rule for the entity management policy.

Examples:

# manage all the VKS clusters in the "prod-ns" namespace
rule:
  apiGroup: "cluster.x-k8s.io"
  kind: "Cluster"
  namespaces:
    nameSelector: ["prod-ns"]
# manage all the VKS clusters in the "test-ns" namespace with the label "key1=value1"
rule:
  apiGroup: "cluster.x-k8s.io"
  kind: "Cluster"
  namespaces:
    nameSelector: ["test-ns"]
  labelSelector:
    matchLabels:
      key1: value1
Appears In:
Field Description Default Validation

apiGroup string

apiGroup is the API group of the managed entities.

Enum: [cluster.x-k8s.io]

kind string

kind is the kind of the managed entities.

Enum: [Cluster]

namespaces Namespaces

namespaces specify the namespaces where the managed entities locate.

nameSelector string array

nameSelector filters the managed entities by names.

labelSelector LabelSelector

labelSelector filters the managed entities by labels.

celSelector CELSelector

celSelector filters the managed entities by CEL expression.

EntityManagementPolicySpec

Appears In:
Field Description Default Validation

enabled boolean

enabled indicates whether the entity management policy is enabled.

true

rules EntityManagementPolicyRule array

rules specifies the rules for the entity management policy.

config ArgoCDConfig

config specifies the ArgoCD config for the entity management policy.

EntityManagementPolicyStatus

Appears In:
Field Description Default Validation

conditions Condition array

conditions records the conditions for the policy.

MaxItems: 32

observedGeneration integer

observedGeneration is the metadata.generation of the resource that was last reconciled.

decisions Decision array

decisions records the decisions for the targets.

KeyValues

KeyValues represents a flexible key-value map for arbitrary configuration. This type is used for OIDC claims and other dynamic configuration that doesn’t have a fixed schema. The structure preserves any fields provided without validation, allowing for flexible configuration.

Appears In:
Field Description Default Validation

Object object (keys:string, values:interface{})

Object is a JSON compatible map with string, float, int, bool, []interface{}, or
map[string]interface{}
children.

ManagedEntity

ManagedEntity defines a destination cluster registered and managed under ArgoCD. It represents either a Supervisor Namespace or a VKS cluster in either VCF Automation or native Supervisor scope.

Field Description Default Validation

apiVersion string

argocd-service.vsphere.vmware.com/v1alpha1

kind string

ManagedEntity

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec ManagedEntitySpec

spec specifies the desired configuration and target reference of the ManagedEntity.

status ManagedEntityStatus

status specifies the observed state and phase of the ManagedEntity.

ManagedEntitySpec

ManagedEntitySpec defines the desired configuration of a ManagedEntity, including the target cluster reference, controlled namespaces, and cluster secret customization options.

Examples:

# Supervisor Namespace in VCF Automation — manage a single Supervisor Namespace in VCF Automation
spec:
  targetRef:
    apiGroup: ""
    kind: Namespace
    name: my-namespace
    project: default-project
# Supervisor Namespace in native Supervisor — manage a single Supervisor Namespace in native Supervisor
spec:
  targetRef:
    apiGroup: ""
    kind: Namespace
    name: my-namespace
# VKS Cluster in VCF Automation — manage a VKS cluster in VCF Automation
spec:
  targetRef:
    apiGroup: cluster.x-k8s.io
    kind: Cluster
    name: my-cluster
    namespace: vks-ns
    project: default-project
# VKS Cluster in native Supervisor — manage a VKS cluster in native Supervisor
spec:
  targetRef:
    apiGroup: cluster.x-k8s.io
    kind: Cluster
    name: my-cluster
    namespace: vks-ns
Appears In:
Field Description Default Validation

targetRef TargetRef

targetRef specifies the reference to the target Supervisor Namespace or VKS cluster that ArgoCD should manage.

namespaces string array

namespaces specifies the list of namespaces inside the target cluster that ArgoCD is permitted to manage.
For Supervisor Namespace targets (kind="Namespace"), this list must be empty or contain exactly one namespace that matches the target name (spec.targetRef.name). If empty, it defaults to the targeted namespace itself.
For VKS cluster targets (kind="Cluster"), leaving this list empty or nil grants ArgoCD access to all namespaces within that cluster. If specified, it restricts ArgoCD’s access to only the listed namespaces.

secretLabels object (keys:string, values:string)

secretLabels specifies custom labels to apply to the generated ArgoCD cluster secret.
The label "argocd.argoproj.io/secret-type: cluster" is automatically added by the controller.

secretAnnotations object (keys:string, values:string)

secretAnnotations specifies custom annotations to apply to the generated ArgoCD cluster secret.
The annotation "argocd-service.vsphere.vmware.com/managed-by: <managed-entity-name>" is automatically added by the controller.

argoCDProject string

argoCDProject specifies the ArgoCD AppProject to associate this cluster with.
This maps to the "project" key in the generated ArgoCD cluster secret’s data.
If empty, the cluster is associated with the default ArgoCD project.

proxy string

proxy specifies the HTTP/HTTPS proxy URL to use for communication with the target cluster.
This maps to the "proxyUrl" field in the generated ArgoCD cluster secret’s configuration.

disableCompression boolean

disableCompression specifies whether to disable automatic compression for requests to the target cluster.
This maps to the "disableCompression" field in the generated ArgoCD cluster secret’s configuration. Disabling compression can be useful for limited bandwidth or high-latency connections.

clusterName string

clusterName specifies a custom display name for the cluster inside ArgoCD.
This maps to the "name" key in the generated ArgoCD cluster secret’s data. If not specified, a default display name is automatically derived:
for Supervisor Namespaces, it defaults to the namespace name;
for VKS clusters, it defaults to "<cluster-name>-<namespace>".

ManagedEntityStatus

ManagedEntityStatus defines the observed state of ManagedEntity.

Appears In:
Field Description Default Validation

conditions Condition array

conditions specifies the current conditions of the ManagedEntity, representing the detailed status of each step in the reconciliation pipeline.

observedGeneration integer

observedGeneration specifies the .metadata.generation that was last reconciled by the controller.

phase string

phase specifies the current high-level state of the ManagedEntity.
Supported values are "Ready" (all reconciliation steps succeeded, and the ArgoCD cluster secret is healthy),
"Pending" (reconciliation is in progress or waiting for prerequisites),
"Failed" (reconciliation encountered a terminal error or validation failure),
or "Unknown".

clusterType string

clusterType specifies the derived type of the target cluster.
Supported values are "SupervisorNamespaceInProject", "SupervisorNamespace", "VKSClusterInProject", "VKSCluster", or "Unknown".

secretRef SecretReference

secretRef specifies the reference to the generated Kubernetes Secret containing the ArgoCD cluster configuration and credentials.

clusterEndpointURL string

clusterEndpointURL specifies the secure Kubernetes API server endpoint URL of the target cluster.

Namespaces

Appears In:
Field Description Default Validation

nameSelector string array

nameSelector filters the namespaces by names.

MinItems: 1

PlatformServiceAccountStatus

PlatformServiceAccountStatus tracks the state of the auto-created VCF Automation service account.

Appears In:
Field Description Default Validation

name string

name is the name of the auto-generated VCF Automation service account.

MinLength: 1

id string

id is the unique identifier for the auto-generated VCF Automation service account.

MinLength: 1

ResourceHealthCheck

ResourceHealthCheck defines a custom Lua health check script for a specific Kubernetes resource. This follows the ArgoCD operator pattern for defining resource health checks.

Example:

resourceHealthChecks:
  - group: certmanager.k8s.io
    kind: Certificate
    check: |
      hs = {}
      if obj.status ~= nil then
        if obj.status.conditions ~= nil then
          for i, condition in ipairs(obj.status.conditions) do
            if condition.type == "Ready" and condition.status == "False" then
              hs.status = "Degraded"
              hs.message = condition.message
              return hs
            end
            if condition.type == "Ready" and condition.status == "True" then
              hs.status = "Healthy"
              hs.message = condition.message
              return hs
            end
          end
        end
      end
      hs.status = "Progressing"
      hs.message = "Waiting for certificate"
      return hs
  - group: cluster.x-k8s.io
    kind: "*"
    check: |
      hs = {}
      hs.status = "Progressing"
      hs.message = "Waiting for cluster"
      return hs
Appears In:
Field Description Default Validation

group string

group specifies the API group of the resource.
Use "" for core API group (e.g., Pod, Service), or "*" to match all groups.
Example: "certmanager.k8s.io", "apps", ""

kind string

kind specifies the resource kind.
Use "" to match all kinds within the specified group.
This field is part of the composite map key (group + kind).
Example: "Certificate", "Deployment", ""

MinLength: 1

check string

check is a Lua script that evaluates the health status of the resource.
The script receives the resource object as 'obj' and must return a table
with 'status' and 'message' fields.
Valid status values: "Healthy", "Progressing", "Degraded", "Suspended", "Missing", "Unknown"

MinLength: 1

SupervisorServiceAccountStatus

SupervisorServiceAccountStatus tracks the state of the auto-created K8S service account.

Appears In:
Field Description Default Validation

name string

name is the name of the auto-created K8S service account.

MinLength: 1

namespace string

namespace is the namespace of the auto-created K8S service account.

MinLength: 1

TLSCert

TLSCert contains TLS certificate, private key, and CA certificate for HTTPS configuration. All values must be base64-encoded.

Appears In:
Field Description Default Validation

key string

key specifies the base64-encoded private key for the TLS certificate.
Deprecated: Use SecretRef instead for improved security. This field will be removed in a future release.

MinLength: 1

cert string

cert specifies the base64-encoded TLS certificate.
Deprecated: Use SecretRef instead for improved security. This field will be removed in a future release.

MinLength: 1

ca string

ca specifies the base64-encoded certificate authority (CA) certificate.
Deprecated: Use SecretRef instead for improved security. This field will be removed in a future release.

MinLength: 1

secretRef SecretReference

secretRef references a Kubernetes Secret containing TLS certificate data
The secret must contain the following keys:

  • tls.key: TLS private key (PEM format or base64-encoded)

  • tls.crt: TLS certificate (PEM format or base64-encoded)

  • ca.crt: CA certificate (PEM format or base64-encoded, optional)

TargetRef

TargetRef defines a reference to a target cluster (Supervisor Namespace or VKS cluster) that ArgoCD should manage.

Supported target cluster types:

  • Supervisor Namespace in VCF Automation: apiGroup="", kind="Namespace", name=<ns-name>, project=<project>

  • Supervisor Namespace in native Supervisor: apiGroup="", kind="Namespace", name=<ns-name>

  • VKS Cluster in VCF Automation: apiGroup="cluster.x-k8s.io", kind="Cluster", name=<cluster>, namespace=<ns>, project=<project>

  • VKS Cluster in native Supervisor: apiGroup="cluster.x-k8s.io", kind="Cluster", name=<cluster>, namespace=<ns>

Appears In:
Field Description Default Validation

apiGroup string

apiGroup specifies the API group of the target resource.
Use an empty string "" for a Supervisor Namespace, or "cluster.x-k8s.io" for a VKS cluster.

kind string

kind specifies the schema kind of the target resource.
Supported values are "Namespace" (for a Supervisor Namespace) or "Cluster" (for a VKS cluster).

name string

name specifies the resource name of the target Supervisor Namespace or VKS cluster.

namespace string

namespace specifies the vSphere namespace where the target VKS cluster resides.
This field is required for VKS clusters (kind="Cluster") and must be empty or omitted for Supervisor Namespaces (kind="Namespace").

project string

project specifies the VCF Automation (VCF-A) project name that the target resource belongs to.
This field is required when operating under VCF Automation scope, and must be empty or omitted when operating under direct native Supervisor scope.

VCFAOIDCConfigStatus

VCFAOIDCConfigStatus tracks the OIDC configuration created in the VCF Automation tenant portal

Appears In:
Field Description Default Validation

name string

name is the name of OIDC RelyingParty created in the VCF Automation

MinLength: 1

id string

id is the unique identifier for the OIDC RelyingParty created in the VCF Automation

MinLength: 1

issuer string

issuer is the OIDC RelyingParty issuer URL

MinLength: 1

clientId string

clientId is the OIDC RelyingParty client ID retrieved from OIDC RelyingParty

MinLength: 1

enablePKCEAuthentication boolean

enablePKCEAuthentication indicates if PKCE authentication is enabled.
When not set, the value is treated as false.

requestedScopes string array

requestedScopes specifies the OAuth2 scopes to request

redirectUris string array

redirectUris are the redirect URIs configured for the OIDC RelyingParty