API Reference

Packages

• evpn.networking.metal.ironcore.dev/v1alpha1
• networking.metal.ironcore.dev/v1alpha1
• nx.cisco.networking.metal.ironcore.dev/v1alpha1
• overlay.networking.metal.ironcore.dev/v1alpha1
• pool.networking.metal.ironcore.dev/v1alpha1
• xe.cisco.networking.metal.ironcore.dev/v1alpha1
• xr.cisco.networking.metal.ironcore.dev/v1alpha1

evpn.networking.metal.ironcore.dev/v1alpha1

Package v1alpha1 contains API Schema definitions for the evpn.networking.metal.ironcore.dev v1alpha1 API group.

Resource Types

• Fabric

AnycastRendezvousPoint

AnycastRendezvousPoint defines an anycast PIM rendezvous point group.

Appears in:

• FabricPIMSpec

Field	Description	Default	Validation
name string	name is a unique identifier for this rendezvous point group within the fabric.		MaxLength: 63 MinLength: 1 Required: {}
multicastGroups IPPrefix array	multicastGroups lists the multicast group address ranges served by this rendezvous point. Each entry must be a valid IPv4 multicast CIDR prefix.		Format: cidr MinItems: 1 Type: string Required: {}
deviceSelector LabelSelector	deviceSelector identifies which devices are configured as rendezvous points in this group.		Required: {}
clientDeviceSelector LabelSelector	clientDeviceSelector identifies the devices that register with the rendezvous points in this group.		Required: {}

BUMType

Underlying type: string

BUMType is the mechanism used to handle BUM (Broadcast, Unknown unicast, Multicast) traffic in the fabric.

Validation:

• Enum: [Multicast]

Appears in:

• FabricBUMSpec

Field	Description
Multicast	BUMTypeMulticast uses PIM sparse mode for BUM traffic forwarding.

Fabric

Fabric is the Schema for the fabrics API

Field	Description	Default	Validation
apiVersion string	evpn.networking.metal.ironcore.dev/v1alpha1
kind string	Fabric
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec FabricSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status FabricStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

FabricAnycastGatewaySpec

FabricAnycastGatewaySpec configures the anycast gateway on VTEP devices.

Appears in:

• FabricVTEPSpec

Field	Description	Default	Validation
virtualMAC string	virtualMAC is the shared MAC address used by all anycast gateway instances across the fabric. Must be a valid IEEE 802 MAC address in colon-separated hexadecimal notation (e.g. f0:0c:c1:5c:00:00).		Pattern: ^([0-9a-fA-F]\{2\}:)\{5\}[0-9a-fA-F]\{2\}$ Required: {}

FabricBUMSpec

FabricBUMSpec defines how BUM (Broadcast, Unknown unicast, Multicast) traffic is forwarded across the fabric.

Appears in:

• FabricSpec

Field	Description	Default	Validation
type BUMType	type selects the BUM forwarding mechanism.		Enum: [Multicast] Required: {}
pim FabricPIMSpec	pim configures PIM sparse mode when type is Multicast.		Optional: {}

FabricIBGPSpec

FabricIBGPSpec configures the iBGP overlay control plane.

Appears in:

• FabricOverlaySpec

Field	Description	Default	Validation
asNumber IntOrString	asNumber is the BGP autonomous system number shared by all devices in the iBGP fabric. Supports both plain format (1-4294967295) and dotted notation (1-65535.0-65535) as per RFC 5396.		Required: {}
routeReflectors RouteReflectorGroup array	routeReflectors lists the route reflector groups that provide iBGP scalability. Each group designates a set of reflectors and their client devices.		MinItems: 1 Required: {}

FabricLoopbacksSpec

FabricLoopbacksSpec configures IP address allocation for loopback interfaces.

Appears in:

• FabricSpec

Field	Description	Default	Validation
ipAddressPoolRef LocalObjectReference	ipAddressPoolRef references the IPAddressPool from which loopback addresses are allocated for devices in the fabric.		Required: {}

FabricOverlaySpec

FabricOverlaySpec defines the overlay control-plane configuration.

Appears in:

• FabricSpec

Field	Description	Default	Validation
protocol OverlayProtocol	protocol is the control-plane protocol used for the EVPN overlay.		Enum: [IBGP] Required: {}
ibgp FabricIBGPSpec	ibgp configures the iBGP overlay when protocol is IBGP.		Optional: {}

FabricPIMSpec

FabricPIMSpec configures PIM sparse mode for BUM traffic.

Appears in:

• FabricBUMSpec

Field	Description	Default	Validation
anycastRendezvousPoints AnycastRendezvousPoint array	anycastRendezvousPoints lists the anycast rendezvous point groups used for PIM sparse mode. Anycast RPs share the same IP address across multiple devices for redundancy.		MinItems: 1 Required: {}

FabricSpec

FabricSpec defines the desired state of Fabric.

Appears in:

• Fabric

Field	Description	Default	Validation
deviceSelector LabelSelector	deviceSelector identifies which devices are members of this fabric. All devices whose labels match this selector will be enrolled. A device must not match the deviceSelector of more than one Fabric; overlapping selectors lead to undefined behaviour as both controllers will compete for ownership of the device's sub-resources.		Required: {}
loopbacks FabricLoopbacksSpec	loopbacks configures IP address allocation for loopback interfaces on fabric devices.		Required: {}
underlay FabricUnderlaySpec	underlay defines the underlay routing configuration for the fabric.		Required: {}
overlay FabricOverlaySpec	overlay defines the overlay control-plane configuration for the fabric.		Required: {}
bum FabricBUMSpec	bum defines how BUM traffic is forwarded across the fabric.		Required: {}
vtep FabricVTEPSpec	vtep identifies the VTEP devices and configures their anycast gateway.		Required: {}
vniPool TypedLocalObjectReference	vniPool references an IndexPool from which VNIs are allocated for Networks realized by this Fabric. This field is introduced as optional until the NetworkAttachment controller is implemented. The field currently has no effect.		Optional: {}

FabricStatus

FabricStatus defines the observed state of Fabric.

Appears in:

• Fabric

Field	Description	Default	Validation
conditions Condition array	conditions represent the current state of the Fabric resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. The status of each condition is one of True, False, or Unknown.		Optional: {}

FabricUnderlayAddressingSpec

FabricUnderlayAddressingSpec configures how IP addresses are assigned to underlay point-to-point links.

Appears in:

• FabricUnderlaySpec

Field	Description	Default	Validation
ipPrefixPoolRef LocalObjectReference	ipPrefixPoolRef references the IPPrefixPool from which point-to-point prefixes are allocated for underlay interfaces.		Optional: {}
unnumbered boolean	unnumbered controls whether underlay interfaces use unnumbered addressing (borrowing from loopback0) instead of dedicated point-to-point addresses.	false	Optional: {}

FabricUnderlaySpec

FabricUnderlaySpec defines the underlay network configuration.

Appears in:

• FabricSpec

Field	Description	Default	Validation
protocol UnderlayProtocol	protocol is the routing protocol used to build IP reachability across the fabric underlay.		Enum: [OSPF ISIS] Required: {}
interfaceSelector LabelSelector	interfaceSelector identifies which interfaces participate in the underlay. Interfaces on fabric devices matching these labels will be enrolled in the underlay routing process.		Required: {}
addressing FabricUnderlayAddressingSpec	addressing configures how IP addresses are assigned to underlay interfaces.		Required: {}

FabricVTEPSpec

FabricVTEPSpec identifies which devices act as VXLAN Tunnel Endpoints (VTEPs) and optionally configures their shared anycast gateway.

Appears in:

• FabricSpec

Field	Description	Default	Validation
deviceSelector LabelSelector	deviceSelector identifies which devices are configured as VTEPs.		Required: {}
anycastGateway FabricAnycastGatewaySpec	anycastGateway configures the anycast gateway shared across all VTEP devices.		Optional: {}

OverlayProtocol

Underlying type: string

OverlayProtocol is the control-plane protocol used for the overlay network.

Validation:

• Enum: [IBGP]

Appears in:

• FabricOverlaySpec

Field	Description
IBGP	OverlayProtocolIBGP uses iBGP EVPN for the overlay control plane.

RouteReflectorGroup

RouteReflectorGroup defines a set of BGP route reflectors and their clients.

Appears in:

• FabricIBGPSpec

Field	Description	Default	Validation
name string	name is a unique identifier for this route reflector group within the fabric.		MaxLength: 63 MinLength: 1 Required: {}
deviceSelector LabelSelector	deviceSelector identifies which devices act as route reflectors in this group.		Required: {}
clientDeviceSelector LabelSelector	clientDeviceSelector identifies the devices that are route reflector clients for this group.		Required: {}

UnderlayProtocol

Underlying type: string

UnderlayProtocol is the routing protocol used for the underlay network.

Validation:

• Enum: [OSPF ISIS]

Appears in:

• FabricUnderlaySpec

Field	Description
OSPF	UnderlayProtocolOSPF uses OSPF for underlay routing.
ISIS	UnderlayProtocolISIS uses IS-IS for underlay routing.

networking.metal.ironcore.dev/v1alpha1

Package v1alpha1 contains API Schema definitions for the networking.metal.ironcore.dev v1alpha1 API group.

Resource Types

• AAA
• BGP
• BGPPeer
• Banner
• Certificate
• CommunitySet
• ConfigBackup
• ConsoleConnection
• DHCPRelay
• DNS
• Device
• EVPNInstance
• EthernetSegment
• ISIS
• Interface
• LLDP
• ManagementAccess
• NTP
• NetworkVirtualizationEdge
• OSPF
• PIM
• PrefixSet
• Probe
• RoutingPolicy
• SNMP
• StaticRoute
• Syslog
• User
• VLAN
• VRF

AAA

AAA is the Schema for the aaa API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	AAA
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec AAASpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status AAAStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

AAAAccounting

AAAAccounting defines the AAA accounting method list.

Appears in:

• AAASpec

Field	Description	Default	Validation
methods AAAMethod array	Methods is the ordered list of accounting methods. Methods are tried in order until one succeeds or all fail.		MaxItems: 4 MinItems: 1 Required: {}

AAAAuthentication

AAAAuthentication defines the AAA authentication method list.

Appears in:

• AAASpec

Field	Description	Default	Validation
methods AAAMethod array	Methods is the ordered list of authentication methods. Methods are tried in order until one succeeds or all fail.		MaxItems: 4 MinItems: 1 Required: {}

AAAAuthorization

AAAAuthorization defines the AAA authorization method list.

Appears in:

• AAASpec

Field	Description	Default	Validation
methods AAAMethod array	Methods is the ordered list of authorization methods. Methods are tried in order until one succeeds or all fail.		MaxItems: 4 MinItems: 1 Required: {}

AAAMethod

AAAMethod represents an AAA method.

Appears in:

• AAAAccounting
• AAAAuthentication
• AAAAuthorization

Field	Description	Default	Validation
type AAAMethodType	Type is the type of AAA method.		Enum: [Group Local None] Required: {}
groupName string	GroupName is the name of the server group when Type is Group.		MaxLength: 63 Optional: {}

AAAMethodType

Underlying type: string

AAAMethodType defines the type of AAA method.

Validation:

• Enum: [Group Local None]

Appears in:

• AAAMethod

Field	Description
Group	AAAMethodTypeGroup uses a server group (e.g., TACACS+ group).
Local	AAAMethodTypeLocal uses the local user database.
None	AAAMethodTypeNone allows access without authentication.

AAAServer

AAAServer represents a single AAA server within a group.

Appears in:

• AAAServerGroup

Field	Description	Default	Validation
address string	Address is the IP address or hostname of the server.		MaxLength: 253 MinLength: 1 Required: {}
timeout Duration	Timeout is the response timeout for this server.		Optional: {}
tacacs AAAServerTACACS	TACACS contains TACACS+ specific server configuration. Required when the parent server group type is TACACS.		Optional: {}
radius AAAServerRADIUS	RADIUS contains RADIUS specific server configuration. Required when the parent server group type is RADIUS.		Optional: {}

AAAServerGroup

AAAServerGroup represents a named group of AAA servers.

Appears in:

• AAASpec

Field	Description	Default	Validation
name string	Name is the name of the server group.		MaxLength: 63 MinLength: 1 Required: {}
type AAAServerGroupType	Type is the protocol type of this server group.		Enum: [TACACS RADIUS] Required: {}
servers AAAServer array	Servers is the list of servers in this group.		MaxItems: 16 MinItems: 1 Required: {}
vrfName string	VrfName is the VRF to use for communication with the servers in this group.		MaxLength: 63 Optional: {}
sourceInterfaceName string	SourceInterfaceName is the source interface to use for communication with the servers.		MaxLength: 63 Optional: {}

AAAServerGroupType

Underlying type: string

AAAServerGroupType defines the protocol type of an AAA server group.

Validation:

• Enum: [TACACS RADIUS]

Appears in:

• AAAServerGroup

Field	Description
TACACS	AAAServerGroupTypeTACACS is a TACACS+ server group.
RADIUS	AAAServerGroupTypeRADIUS is a RADIUS server group.

AAAServerRADIUS

AAAServerRADIUS contains RADIUS specific server configuration.

Appears in:

• AAAServer

Field	Description	Default	Validation
authenticationPort integer	AuthenticationPort is the UDP port for RADIUS authentication requests. Defaults to 1812 if not specified.	1812	Maximum: 65535 Minimum: 1 Optional: {}
accountingPort integer	AccountingPort is the UDP port for RADIUS accounting requests. Defaults to 1813 if not specified.	1813	Maximum: 65535 Minimum: 1 Optional: {}
keySecretRef SecretKeySelector	KeySecretRef is a reference to a secret containing the plain text shared key for this RADIUS server. The secret must contain a key specified in the SecretKeySelector.		Required: {}

AAAServerTACACS

AAAServerTACACS contains TACACS+ specific server configuration.

Appears in:

• AAAServer

Field	Description	Default	Validation
port integer	Port is the TCP port of the TACACS+ server. Defaults to 49 if not specified.	49	Maximum: 65535 Minimum: 1 Optional: {}
keySecretRef SecretKeySelector	KeySecretRef is a reference to a secret containing the plain text shared key for this TACACS+ server. The secret must contain a key specified in the SecretKeySelector.		Required: {}

AAASpec

AAASpec defines the desired state of AAA.

It models the Authentication, Authorization, and Accounting (AAA) configuration on a network device.

Appears in:

• AAA

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this AAA. This reference is used to link the AAA to its provider-specific configuration.		Optional: {}
serverGroups AAAServerGroup array	ServerGroups is the list of AAA server groups.		MaxItems: 8 Optional: {}
authentication AAAAuthentication	Authentication defines the AAA authentication method list.		Optional: {}
authorization AAAAuthorization	Authorization defines the AAA authorization method list.		Optional: {}
accounting AAAAccounting	Accounting defines the AAA accounting method list.		Optional: {}

AAAStatus

AAAStatus defines the observed state of AAA.

Appears in:

• AAA

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the AAA.		Optional: {}

ACLAction

Underlying type: string

ACLAction represents the type of action that can be taken by an ACL rule.

Validation:

• Enum: [Permit Deny]

Appears in:

• ACLEntry

Field	Description
Permit	ActionPermit allows traffic that matches the rule.
Deny	ActionDeny blocks traffic that matches the rule.

ACLEntry

Appears in:

• AccessControlListSpec

Field	Description	Default	Validation
sequence integer	The sequence number of the ACL entry.		Minimum: 1 Required: {}
action ACLAction	The forwarding action of the ACL entry.		Enum: [Permit Deny] Required: {}
protocol Protocol	The protocol to match. If not specified, defaults to "IP". Available options are: ICMP, IP, OSPF, PIM, TCP, UDP.	IP	Enum: [ICMP IP OSPF PIM TCP UDP] Optional: {}
sourceAddress IPPrefix	Source IP address prefix. Can be IPv4 or IPv6. Use 0.0.0.0/0 (::/0) to represent 'any'.		Format: cidr Type: string Required: {}
destinationAddress IPPrefix	Destination IP address prefix. Can be IPv4 or IPv6. Use 0.0.0.0/0 (::/0) to represent 'any'.		Format: cidr Type: string Required: {}
description string	Description provides a human-readable description of the ACL entry.		MaxLength: 63 MinLength: 1 Optional: {}

AddressFamily

Underlying type: string

AddressFamily represents the address family of an ISIS instance.

Validation:

• Enum: [IPv4Unicast IPv6Unicast]

Appears in:

• ISISSpec

Field	Description
IPv4Unicast
IPv6Unicast

AddressFamilyStatus

AddressFamilyStatus defines the prefix exchange statistics for a single address family (e.g., IPv4-Unicast).

Appears in:

• BGPPeerStatus

Field	Description	Default	Validation
afiSafi BGPAddressFamilyType	AfiSafi identifies the address family and subsequent address family.		Enum: [IPv4Unicast IPv6Unicast L2vpnEvpn] Required: {}
acceptedPrefixes integer	AcceptedPrefixes is the number of prefixes received from the peer that have passed the inbound policy and are stored in the neighbor-specific table (Adj-RIB-In).		Minimum: 0 Optional: {}
advertisedPrefixes integer	AdvertisedPrefixes is the number of prefixes currently being advertised to the peer after passing the outbound policy. This reflects the state of the outbound routing table for the peer (Adj-RIB-Out).		Minimum: 0 Optional: {}

AdminState

Underlying type: string

AdminState represents the administrative state of a resource. This type is used across multiple resources including interfaces, protocols (BGP, OSPF, ISIS, PIM), and system services (NTP, DNS) to indicate whether these are administratively enabled or disabled.

Validation:

• Enum: [Up Down]

Appears in:

• BGPPeerSpec
• BGPSpec
• BorderGatewaySpec
• DNSSpec
• ISISSpec
• InterfaceSpec
• LLDPInterface
• LLDPSpec
• NTPSpec
• NetworkVirtualizationEdgeSpec
• OSPFSpec
• PIMSpec
• Peer
• VLANSpec
• VPCDomainSpec

Field	Description
Up	AdminStateUp indicates that the resource is administratively enabled.
Down	AdminStateDown indicates that the resource is administratively disabled.

Aggregation

Appears in:

• InterfaceSpec

Field	Description	Default	Validation
memberInterfaceRefs LocalObjectReference array	MemberInterfaceRefs is a list of interface references that are part of the aggregate interface.		MaxItems: 32 MinItems: 1 Required: {}
controlProtocol ControlProtocol	ControlProtocol defines the lacp configuration for the aggregate interface.	{ mode:Active }	Optional: {}
multichassis MultiChassis	Multichassis defines the multichassis configuration for the aggregate interface.		Optional: {}

AllowedVlansMode

Underlying type: string

AllowedVlansMode defines how trunk allowed VLANs are managed.

Validation:

• Enum: [Exact Unmanaged]

Appears in:

• Switchport

Field	Description
Exact	AllowedVlansModeExact means the operator owns the complete trunk allow-list.
Unmanaged	AllowedVlansModeUnmanaged means the operator leaves the trunk allow-list unchanged.

AnycastGateway

AnycastGateway defines distributed anycast gateway configuration. Multiple NVEs in the fabric share the same virtual MAC address, enabling active-active default gateway redundancy for hosts.

Appears in:

• NetworkVirtualizationEdgeSpec

Field	Description	Default	Validation
virtualMAC string	VirtualMAC is the shared MAC address used by all NVEs in the fabric for anycast gateway functionality on RoutedVLAN (SVI) interfaces. All switches in the fabric must use the same MAC address. Format: IEEE 802 MAC-48 address (e.g., "00:00:5E:00:01:01")		Pattern: ^([0-9A-Fa-f]\{2\}:)\{5\}[0-9A-Fa-f]\{2\}$ Required: {}

BFD

BFD defines the Bidirectional Forwarding Detection configuration for interfaces, bgp peerings and static routes.

Appears in:

• BGPPeerSpec
• InterfaceSpec

Field	Description	Default	Validation
enabled boolean	Enabled indicates whether BFD is enabled on the network object.		Required: {}
desiredMinimumTxInterval Duration	DesiredMinimumTxInterval is the minimum interval between transmission of BFD control packets that the operator desires. This value is advertised to the peer. The actual interval used is the maximum of this value and the remote required-minimum-receive interval value.		Pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$ Type: string Optional: {}
requiredMinimumReceive Duration	RequiredMinimumReceive is the minimum interval between received BFD control packets that this system should support. This value is advertised to the remote peer to indicate the maximum frequency between BFD control packets that is acceptable to the local system.		Pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$ Type: string Optional: {}
detectionMultiplier integer	DetectionMultiplier is the number of packets that must be missed to declare this session as down. The detection interval for the BFD session is calculated by multiplying the value of the negotiated transmission interval by this value.		Maximum: 255 Minimum: 1 Optional: {}

BGP

BGP is the Schema for the bgp API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	BGP
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec BGPSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status BGPStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

BGPAddressFamilies

BGPAddressFamilies defines the configuration for supported BGP address families.

Appears in:

• BGPSpec

Field	Description	Default	Validation
ipv4Unicast BGPUnicastAddressFamily	Ipv4Unicast configures IPv4 unicast address family support. Enables exchange of IPv4 unicast routes between BGP peers.		Optional: {}
ipv6Unicast BGPUnicastAddressFamily	Ipv6Unicast configures IPv6 unicast address family support. Enables exchange of IPv6 unicast routes between BGP peers.		Optional: {}
l2vpnEvpn BGPL2vpnEvpn	L2vpnEvpn configures L2VPN EVPN address family support. Enables exchange of Ethernet VPN routes for overlay network services.		Optional: {}

BGPAddressFamily

BGPAddressFamily defines common configuration for a BGP address family.

Appears in:

• BGPL2vpnEvpn
• BGPUnicastAddressFamily

Field	Description	Default	Validation
enabled boolean	Enabled determines whether this address family is activated for BGP sessions. When false, the address family is not negotiated with peers.		Optional: {}
multipath BGPMultipath	Multipath configures address family specific multipath behavior. When specified, overrides global multipath settings for this address family.		Optional: {}

BGPAddressFamilyType

Underlying type: string

BGPAddressFamilyType represents the BGP address family identifier (AFI/SAFI combination).

Validation:

• Enum: [IPv4Unicast IPv6Unicast L2vpnEvpn]

Appears in:

• AddressFamilyStatus

Field	Description
IPv4Unicast	BGPAddressFamilyIpv4Unicast represents the IPv4 Unicast address family (AFI=1, SAFI=1).
IPv6Unicast	BGPAddressFamilyIpv6Unicast represents the IPv6 Unicast address family (AFI=2, SAFI=1).
L2vpnEvpn	BGPAddressFamilyL2vpnEvpn represents the L2VPN EVPN address family (AFI=25, SAFI=70).

BGPCommunityType

Underlying type: string

BGPCommunityType represents the type of BGP community attributes that can be sent to peers.

Validation:

• Enum: [Standard Extended Both]

Appears in:

• BGPPeerAddressFamily

Field	Description
Standard	BGPCommunityTypeStandard sends only standard community attributes (RFC 1997)
Extended	BGPCommunityTypeExtended sends only extended community attributes (RFC 4360)
Both	BGPCommunityTypeBoth sends both standard and extended community attributes

BGPL2vpnEvpn

BGPL2vpnEvpn defines the configuration for L2VPN EVPN address family.

Appears in:

• BGPAddressFamilies

Field	Description	Default	Validation
enabled boolean	Enabled determines whether this address family is activated for BGP sessions. When false, the address family is not negotiated with peers.		Optional: {}
multipath BGPMultipath	Multipath configures address family specific multipath behavior. When specified, overrides global multipath settings for this address family.		Optional: {}
routeTargetPolicy BGPRouteTargetPolicy	RouteTargetPolicy configures route target filtering behavior for EVPN routes. Controls which routes are retained based on route target matching.		Optional: {}

BGPMultipath

BGPMultipath defines the configuration for BGP multipath behavior.

Appears in:

• BGPAddressFamily
• BGPL2vpnEvpn
• BGPUnicastAddressFamily

Field	Description	Default	Validation
enabled boolean	Enabled determines whether BGP is allowed to use multiple paths for forwarding. When false, BGP will only use a single best path regardless of multiple equal-cost paths.		Optional: {}
ebgp BGPMultipathEbgp	Ebgp configures multipath behavior for external BGP (eBGP) paths.		Optional: {}
ibgp BGPMultipathIbgp	Ibgp configures multipath behavior for internal BGP (iBGP) paths.		Optional: {}

BGPMultipathEbgp

BGPMultipathEbgp defines the configuration for eBGP multipath behavior.

Appears in:

• BGPMultipath

Field	Description	Default	Validation
allowMultipleAs boolean	AllowMultipleAs enables the use of multiple paths with different AS paths for eBGP. When true, relaxes the requirement that multipath candidates must have identical AS paths. This corresponds to the "RelaxAs" mode.		Optional: {}
maximumPaths integer	MaximumPaths sets the maximum number of eBGP paths that can be used for multipath load balancing. Valid range is 1-64 when specified. When omitted, no explicit limit is configured.		Maximum: 64 Minimum: 1 Optional: {}

BGPMultipathIbgp

BGPMultipathIbgp defines the configuration for iBGP multipath behavior.

Appears in:

• BGPMultipath

Field	Description	Default	Validation
maximumPaths integer	MaximumPaths sets the maximum number of iBGP paths that can be used for multipath load balancing. Valid range is 1-64 when specified. When omitted, no explicit limit is configured.		Maximum: 64 Minimum: 1 Optional: {}

BGPPeer

BGPPeer is the Schema for the bgppeers API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	BGPPeer
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec BGPPeerSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status BGPPeerStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

BGPPeerAddressFamilies

BGPPeerAddressFamilies defines the address family specific configuration for a BGP peer.

Appears in:

• BGPPeerSpec

Field	Description	Default	Validation
ipv4Unicast BGPPeerAddressFamily	Ipv4Unicast configures IPv4 unicast address family settings for this peer. Controls IPv4 unicast route exchange and peer-specific behavior.		Optional: {}
ipv6Unicast BGPPeerAddressFamily	Ipv6Unicast configures IPv6 unicast address family settings for this peer. Controls IPv6 unicast route exchange and peer-specific behavior.		Optional: {}
l2vpnEvpn BGPPeerAddressFamily	L2vpnEvpn configures L2VPN EVPN address family settings for this peer. Controls EVPN route exchange and peer-specific behavior.		Optional: {}

BGPPeerAddressFamily

BGPPeerAddressFamily defines common configuration for a BGP peer's address family.

Appears in:

• BGPPeerAddressFamilies

Field	Description	Default	Validation
enabled boolean	Enabled determines whether this address family is activated for this specific peer. When false, the address family is not negotiated with this peer. Defaults to false.		Optional: {}
sendCommunity BGPCommunityType	SendCommunity specifies which community attributes should be sent to this BGP peer for this address family. If not specified, no community attributes are sent.		Enum: [Standard Extended Both] Optional: {}
routeReflectorClient boolean	RouteReflectorClient indicates whether this peer should be treated as a route reflector client for this specific address family. Defaults to false.		Optional: {}
inboundRoutingPolicyRef LocalObjectReference	InboundRoutingPolicyRef references a RoutingPolicy applied to routes received from this peer for this address family.		Optional: {}
outboundRoutingPolicyRef LocalObjectReference	OutboundRoutingPolicyRef references a RoutingPolicy applied to routes advertised to this peer for this address family.		Optional: {}

BGPPeerLocalAddress

BGPPeerLocalAddress defines the local address configuration for a BGP peer.

Appears in:

• BGPPeerSpec

Field	Description	Default	Validation
interfaceRef LocalObjectReference	InterfaceRef is a reference to an Interface resource whose IP address will be used as the source address for BGP packets sent to this peer. The Interface object must exist in the same namespace.		Required: {}

BGPPeerSessionState

Underlying type: string

BGPPeerSessionState represents the operational state of a BGP peer session.

Validation:

• Enum: [Idle Connect Active OpenSent OpenConfirm Established Unknown]

Appears in:

• BGPPeerStatus

Field	Description
Idle	BGPPeerSessionStateIdle indicates the peer is down and in the idle state of the FSM.
Connect	BGPPeerSessionStateConnect indicates the peer is down and the session is waiting for the underlying transport session to be established.
Active	BGPPeerSessionStateActive indicates the peer is down and the local system is awaiting a connection from the remote peer.
OpenSent	BGPPeerSessionStateOpenSent indicates the peer is in the process of being established. The local system has sent an OPEN message.
OpenConfirm	BGPPeerSessionStateOpenConfirm indicates the peer is in the process of being established. The local system is awaiting a NOTIFICATION or KEEPALIVE message.
Established	BGPPeerSessionStateEstablished indicates the peer is up - the BGP session with the peer is established.
Unknown	BGPPeerSessionStateUnknown indicates the peer state is unknown.

BGPPeerSpec

BGPPeerSpec defines the desired state of BGPPeer

Appears in:

• BGPPeer

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the BGPPeer to its provider-specific configuration.		Optional: {}
bgpRef LocalObjectReference	BgpRef is a reference to the BGP instance this peer belongs to. The BGP object must exist in the same namespace. Immutable.		Required: {}
adminState AdminState	AdminState indicates whether this BGP peer is administratively up or down. When Down, the BGP session with this peer is administratively shut down.	Up	Enum: [Up Down] Optional: {}
address string	Address is the IPv4 address of the BGP peer. Mutually exclusive with InterfaceRef: exactly one of both must be specified. Immutable.		Format: ipv4 Optional: {}
interfaceRef LocalObjectReference	InterfaceRef is a reference to an Interface resource over which an unnumbered (interface-based) BGP session is established. The peers discover each other over their IPv6 link-local addresses, so the link needs no addressing of its own. The referenced Interface must belong to the same Device, exist in the same namespace, and be configured for link-local operation (spec.ipv6.useLinkLocalOnly). Mutually exclusive with Address: exactly one of both must be specified. Immutable.		Optional: {}
asNumber IntOrString	ASNumber is the autonomous system number (ASN) of the BGP peer. Supports both plain format (1-4294967295) and dotted notation (0-65535.0-65535) as per RFC 5396. The special value "external" configures a dynamic AS number, accepting any AS number that differs from the local one. It is only valid together with InterfaceRef.		Required: {}
description string	Description is an optional human-readable description for this BGP peer. This field is used for documentation purposes and may be displayed in management interfaces.		Optional: {}
localAddress BGPPeerLocalAddress	LocalAddress specifies the local address configuration for the BGP session with this peer. This determines the source address/interface for BGP packets sent to this peer.		Optional: {}
addressFamilies BGPPeerAddressFamilies	AddressFamilies configures address family specific settings for this BGP peer. Controls which address families are enabled and their specific configuration.		Optional: {}
localAS LocalAS	LocalAS configures the local AS number and how it factors into BGP announcements for this peer.		Optional: {}
ttl integer	TTL sets the time-to-live for eBGP sessions that span multiple hops. When set, allows establishing eBGP sessions with non-directly-connected peers by setting the IP TTL of outgoing BGP packets to this value. When unset, eBGP multihop is disabled (equivalent to TTL=1 — directly connected peers only).		Maximum: 255 Minimum: 2 Optional: {}
bfd BFD	BFD defines the Bidirectional Forwarding Detection configuration for the interface. BFD is only applicable for Layer 3 interfaces.		Optional: {}

BGPPeerStatus

BGPPeerStatus defines the observed state of BGPPeer.

Appears in:

• BGPPeer

Field	Description	Default	Validation
sessionState BGPPeerSessionState	SessionState is the current operational state of the BGP session.		Enum: [Idle Connect Active OpenSent OpenConfirm Established Unknown] Optional: {}
lastEstablishedTime Time	LastEstablishedTime is the timestamp when the BGP session last transitioned to the ESTABLISHED state. A frequently changing timestamp indicates session instability (flapping).		Optional: {}
advertisedPrefixesSummary string	AdvertisedPrefixesSummary provides a human-readable summary of advertised prefixes across all address families (e.g., "10 (IPv4Unicast), 5 (IPv6Unicast)"). This field is computed by the controller from the AddressFamilies field.		Optional: {}
addressFamilies AddressFamilyStatus array	AddressFamilies contains per-address-family statistics for this peer. Only address families that are enabled and negotiated with the peer are included.		Optional: {}
peerInterface string	PeerInterface is the device-level name of the interface an unnumbered peer is configured over. It is recorded so that the peer can still be removed from the device after the referenced Interface has been deleted.		Optional: {}
observedGeneration integer	ObservedGeneration reflects the .metadata.generation that was last processed by the controller.		Optional: {}
conditions Condition array	The conditions are a list of status objects that describe the state of the BGP.		Optional: {}

BGPRedistributeDirectRoutes

BGPRedistributeDirectRoutes configures redistribution of directly connected routes into a BGP address family.

Appears in:

• BGPUnicastAddressFamily

Field	Description	Default	Validation
routingPolicyRef LocalObjectReference	RoutingPolicyRef references a RoutingPolicy to apply during redistribution.		Required: {}

BGPRouteTargetPolicy

BGPRouteTargetPolicy defines the policy for route target filtering in EVPN.

Appears in:

• BGPL2vpnEvpn

Field	Description	Default	Validation
retainAll boolean	RetainAll controls whether all route targets are retained regardless of import policy.		Optional: {}

BGPSpec

BGPSpec defines the desired state of BGP

Appears in:

• BGP

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
vrfRef LocalObjectReference	VrfRef is an optional reference to the VRF this BGP instance is scoped to. When omitted, the BGP instance is configured in the default VRF. Immutable.		Optional: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the BGP to its provider-specific configuration.		Optional: {}
adminState AdminState	AdminState indicates whether this BGP router is administratively up or down.	Up	Enum: [Up Down] Optional: {}
asNumber IntOrString	ASNumber is the autonomous system number (ASN) for the BGP router. Supports both plain format (1-4294967295) and dotted notation (0-65535.0-65535) as per RFC 5396. Immutable.		Required: {}
routerId string	RouterID is the BGP router identifier, used in BGP messages to identify the originating router. Follows dotted quad notation (IPv4 format).		Format: ipv4 Required: {}
addressFamilies BGPAddressFamilies	AddressFamilies configures supported BGP address families and their specific settings.		Optional: {}

BGPStatus

BGPStatus defines the observed state of BGP.

Appears in:

• BGP

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the BGP.		Optional: {}

BGPUnicastAddressFamily

BGPUnicastAddressFamily defines configuration for IPv4 and IPv6 unicast address families.

Appears in:

• BGPAddressFamilies

Field	Description	Default	Validation
enabled boolean	Enabled determines whether this address family is activated for BGP sessions. When false, the address family is not negotiated with peers.		Optional: {}
multipath BGPMultipath	Multipath configures address family specific multipath behavior. When specified, overrides global multipath settings for this address family.		Optional: {}
redistributeDirectRoutes BGPRedistributeDirectRoutes	RedistributeDirectRoutes controls redistribution of directly connected routes into this BGP address family.		Optional: {}

Banner

Banner is the Schema for the banners API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	Banner
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec BannerSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status BannerStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

BannerSpec

BannerSpec defines the desired state of Banner

Appears in:

• Banner

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the Banner to its provider-specific configuration.		Optional: {}
type BannerType	Type specifies the banner type to configure, either PreLogin or PostLogin. Immutable.	PreLogin	Enum: [PreLogin PostLogin] Optional: {}
message TemplateSource	Message is the banner message to display.		Required: {}

BannerStatus

BannerStatus defines the observed state of Banner.

Appears in:

• Banner

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the Banner.		Optional: {}

BannerType

Underlying type: string

BannerType represents the type of banner to configure

Validation:

• Enum: [PreLogin PostLogin]

Appears in:

• BannerSpec

Field	Description
PreLogin	BannerTypePreLogin represents the login banner displayed before user authentication. This corresponds to the openconfig-system login-banner leaf.
PostLogin	BannerTypePostLogin represents the message banner displayed after user authentication. This corresponds to the openconfig-system motd-banner leaf.

BgpActions

BgpActions defines BGP-specific actions for a policy statement.

Appears in:

• PolicyActions

Field	Description	Default	Validation
setCommunity SetCommunityAction	SetCommunity configures BGP standard community attributes.		Optional: {}
setExtCommunity SetExtCommunityAction	SetExtCommunity configures BGP extended community attributes.		Optional: {}
setASPath SetASPathAction	SetASPath configures modifications to the BGP AS path attribute.		Optional: {}

Certificate

Certificate is the Schema for the certificates API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	Certificate
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec CertificateSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status CertificateStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

CertificateSource

CertificateSource represents a source for the value of a certificate.

Appears in:

• TLS

Field	Description	Default	Validation
secretRef SecretReference	Secret containing the certificate. The secret must be of type kubernetes.io/tls and as such contain the following keys: 'tls.crt' and 'tls.key'.		Required: {}

CertificateSpec

CertificateSpec defines the desired state of Certificate

Appears in:

• Certificate

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the Certificate to its provider-specific configuration.		Optional: {}
id string	The certificate management id. Immutable.		MaxLength: 63 MinLength: 1 Pattern: ^[a-zA-Z0-9]+$ Required: {}
secretRef SecretReference	Secret containing the certificate source. The secret must be of type kubernetes.io/tls and as such contain the following keys: 'tls.crt' and 'tls.key'.		Required: {}

CertificateStatus

CertificateStatus defines the observed state of Certificate.

Appears in:

• Certificate

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the Certificate.		Optional: {}

ChassisIDType

Underlying type: string

ChassisIDType represents the chassis ID subtype for LLDP neighbor information. See IEEE 802.1AB-2016 section 8.5.2.2 for details.

Appears in:

• Neighbor

Field	Description
ChassisComponent	ChassisIDTypeChassisComponent is EntPhysicalAlias when entPhysClass has a value of ‘chassis(3)’ (IETF RFC 6933)
InterfaceAlias	ChassisIDTypeInterfaceAlias is ifAlias (IETF RFC 2863)
PortComponent	ChassisIDTypePortComponent is entPhysicalAlias when entPhysicalClass has a value ‘port(10)’ or ‘backplane(4)’ (IETF RFC 6933)
MACAddress	ChassisIDTypeMACAddress is the MAC address (IEEE Std 802)
NetworkAddress	ChassisIDTypeNetworkAddress is an octet string representation of a particular network family and address.
InterfaceName	ChassisIDTypeInterfaceName is ifName (IETF RFC 2863)
Local	ChassisIDTypeLocal is an alphanumeric string that and is locally assigned

ChecksumType

Underlying type: string

ChecksumType defines the type of checksum used for image verification.

Validation:

• Enum: [SHA256 MD5]

Appears in:

• Image

Field	Description
SHA256
MD5

CommunityMember

CommunityMember defines one ordered entry in a community-list with a regex pattern.

Appears in:

• CommunitySetSpec

Field	Description	Default	Validation
sequence integer	Sequence is the order of this entry in the community-list.		Minimum: 1 Required: {}
regex string	Regex is a POSIX extended regular expression matching BGP community values.		MinLength: 1 Required: {}

CommunityOperation

Underlying type: string

CommunityOperation defines whether communities are added to the route's existing set (Add) or replace it (Replace).

Validation:

• Enum: [Add Replace]

Appears in:

• SetCommunityAction
• SetExtCommunityAction

Field	Description
Add	CommunityOperationAdd appends the communities to the route's existing set.
Replace	CommunityOperationReplace overwrites the route's communities with the configured set.

CommunitySet

CommunitySet is the Schema for the communitysets API.

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	CommunitySet
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec CommunitySetSpec			Required: {}
status CommunitySetStatus			Optional: {}

CommunitySetMatchCondition

CommunitySetMatchCondition defines the condition for matching against a CommunitySet.

Appears in:

• PolicyConditions

Field	Description	Default	Validation
communitySetRef LocalObjectReference	CommunitySetRef references a CommunitySet in the same namespace. The CommunitySet must exist and belong to the same device.		Required: {}
matchSetOption MatchSetOption	MatchSetOption defines if the route must match 'Any' or 'All' of the community members in the set.	Any	Enum: [Any All] Optional: {}

CommunitySetSpec

CommunitySetSpec defines the desired state of CommunitySet.

Appears in:

• CommunitySet

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceRef is a reference to the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration.		Optional: {}
name string	Name is the name of the CommunitySet on the device. Immutable.		MaxLength: 32 MinLength: 1 Required: {}
type CommunitySetType	Type is the type of the CommunitySet. It can be either "Standard" (a standard BGP community-list) or "Extended" (an extended community-list). Immutable.	Standard	Enum: [Standard Extended] Required: {}
members CommunityMember array	Members is the ordered list of community-list entries.		MaxItems: 100 MinItems: 1 Required: {}

CommunitySetStatus

CommunitySetStatus defines the observed state of CommunitySet.

Appears in:

• CommunitySet

Field	Description	Default	Validation
conditions Condition array	Conditions is a list of status conditions describing the state of the CommunitySet.		Optional: {}

CommunitySetType

Underlying type: string

CommunitySetType selects whether the CommunitySet is a standard BGP community-list or an extended community-list.

Validation:

• Enum: [Standard Extended]

Appears in:

• CommunitySetSpec

Field	Description
Standard	CommunitySetTypeStandard is a standard BGP community-list.
Extended	CommunitySetTypeExtended is an extended BGP community-list.

ConfigBackup

ConfigBackup is the Schema for the configbackups API.

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	ConfigBackup
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ConfigBackupSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status ConfigBackupStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

ConfigBackupEncryption

ConfigBackupEncryption configures encryption for remote backup objects, performed in the controller pod.

Appears in:

• ConfigBackupS3

Field	Description	Default	Validation
algorithm EncryptionAlgorithm	Algorithm is the encryption algorithm to use.		Enum: [AES-256-GCM ChaCha20-Poly1305] Required: {}
keySecret SecretKeySelector	KeySecret references the Secret and key containing the 32-byte encryption key.		Required: {}

ConfigBackupRetention

ConfigBackupRetention defines how many historical backups are kept on the device.

Appears in:

• ConfigBackupSpec

Field	Description	Default	Validation
keepLast integer	KeepLast is the number of most recent backups to keep for Local backups.	1	Maximum: 100 Minimum: 1 Optional: {}

ConfigBackupRunStatus

ConfigBackupRunStatus contains the result of a single successful backup run.

Appears in:

• ConfigBackupStatus

Field	Description	Default	Validation
timestamp Time	Timestamp is the time at which the backup was created on the device.		Required: {}
duration Duration	Duration is the duration of the backup operation.		Required: {}
observedGeneration integer	ObservedGeneration represents the .metadata.generation that produced this backup.		Minimum: 0 Optional: {}
sizeBytes integer	SizeBytes is the size in bytes of the backup artifact. This only applies to Local backups, and may be unknown if the controller cannot query the device.		Minimum: 0 Optional: {}
filepath string	Filepath is the device-local path of the backup artifact. This only applies to Local backups, and may be unknown if the controller cannot query the device.		MinLength: 1 Optional: {}
encryptionAlgorithm EncryptionAlgorithm	EncryptionAlgorithm is the encryption algorithm used for this backup, if any. Only set for encrypted Remote backups.		Enum: [AES-256-GCM ChaCha20-Poly1305] Optional: {}
encryptionKeySecret string	EncryptionKeySecret is the name of the Secret that provided the encryption key. Only set for encrypted Remote backups.		Optional: {}

ConfigBackupS3

ConfigBackupS3 configures the S3-compatible object storage destination for Remote backups.

Appears in:

• ConfigBackupSpec

Field	Description	Default	Validation
endpoint string	Endpoint is the S3-compatible endpoint URL (e.g., "https://s3.eu-central-1.amazonaws.com").		MaxLength: 2048 MinLength: 1 Required: {}
bucket string	Bucket is the name of the S3 bucket.		MaxLength: 63 MinLength: 1 Required: {}
region string	Region is the endpoint region. Optional for S3-compatible stores that don't require it.		MaxLength: 63 Optional: {}
credentialsSecretRef SecretReference	CredentialsSecretRef references a Secret containing "accessKeyID" and "secretAccessKey" keys.		Required: {}
encryption ConfigBackupEncryption	Encryption configures optional encryption for backup objects, performed in the controller pod before upload. If omitted, backups are stored unencrypted.		Optional: {}

ConfigBackupSpec

ConfigBackupSpec defines the desired state of ConfigBackup.

Appears in:

• ConfigBackup

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceRef is a reference to the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the ConfigBackup to its provider-specific configuration.		Optional: {}
schedule string	Schedule is an optional cron expression. If omitted, the controller performs a one-shot backup.		Optional: {}
type ConfigBackupType	Type determines whether the backup is saved as a local file or as startup-config.		Enum: [Local Startup Remote] Required: {}
path string	Path is the device-local destination path for Local backups. Different providers may accept different path formats, such as "bootflash:///backups/".		MaxLength: 255 MinLength: 1 Optional: {}
retention ConfigBackupRetention	Retention configures automatic cleanup of older backups for Local backups.		Optional: {}
storageThreshold ConfigBackupStorageThreshold	StorageThreshold defines the minimum free space that must remain before creating a new Local backup.		Optional: {}
s3 ConfigBackupS3	S3 configures the S3-compatible object storage destination for Remote backups.		Optional: {}

ConfigBackupStatus

ConfigBackupStatus defines the observed state of ConfigBackup.

Appears in:

• ConfigBackup

Field	Description	Default	Validation
conditions Condition array	Conditions represent the current state of the ConfigBackup resource.		Optional: {}
lastBackup ConfigBackupRunStatus	LastBackup contains details about the most recent successful backup operation. This is updated only when a backup completes successfully, and may be nil if no successful backups have occurred.		Optional: {}
lastAttemptTime Time	LastAttemptTime is the timestamp of the most recent backup attempt, regardless of outcome. This is updated whenever the controller attempts to perform a backup, even if it fails.		Optional: {}
oldestBackupTimestamp Time	OldestBackupTimestamp is the timestamp of the oldest discovered backup on the device. This only applies to Local backups, and may be unknown if the controller cannot query the device.		Optional: {}
nextScheduledBackup Time	NextScheduledBackup is the next time at which the controller intends to trigger a backup. This only applies to scheduled backups, and may be unknown if the controller cannot determine the next schedule.		Optional: {}
totalBackups integer	TotalBackups is the number of backups currently discovered on the device. This only applies to Local backups, and may be unknown if the controller cannot query the device. For Startup backups, this is always 1, since the device only maintains a single startup configuration.		Optional: {}
totalSizeBytes integer	TotalSizeBytes is the total size in bytes of the discovered backups on the device. This only applies to Local backups, and may be unknown if the controller cannot query the device.		Optional: {}
storage ConfigBackupStorageStatus	Storage contains device-local storage statistics for the configured backup target. This only applies to Local backups, and may be unknown if the controller cannot query the device.		Optional: {}

ConfigBackupStorageStatus

ConfigBackupStorageStatus contains storage utilization for the configured backup target.

Appears in:

• ConfigBackupStatus

Field	Description	Default	Validation
totalBytes integer	TotalBytes is the total storage capacity in bytes, if known.		Optional: {}
usedBytes integer	UsedBytes is the used storage in bytes, if known.		Optional: {}
freeBytes integer	FreeBytes is the free storage in bytes, if known.		Optional: {}
freePercent integer	FreePercent is the free storage percentage, if known.		Optional: {}
thresholdBreached boolean	ThresholdBreached indicates whether the configured threshold currently blocks new backups.		Optional: {}

ConfigBackupStorageThreshold

ConfigBackupStorageThreshold defines when the controller must stop writing additional backups.

Appears in:

• ConfigBackupSpec

Field	Description	Default	Validation
minFreeBytes integer	MinFreeBytes is the minimum number of free bytes required before a new backup can be written.		Minimum: 0 Optional: {}
minFreePercent integer	MinFreePercent is the minimum percentage of free storage required before a new backup can be written.		Maximum: 100 Minimum: 0 Optional: {}

ConfigBackupType

Underlying type: string

ConfigBackupType defines how the device should persist a configuration backup.

Validation:

• Enum: [Local Startup Remote]

Appears in:

• ConfigBackupSpec

Field	Description
Local	ConfigBackupTypeLocal stores the running configuration in a device-local file path.
Startup	ConfigBackupTypeStartup stores the running configuration as the device startup configuration.
Remote	ConfigBackupTypeRemote uploads the running configuration to an S3-compatible object store.

ConfigMapKeySelector

ConfigMapKeySelector contains enough information to select a key of a ConfigMap.

Appears in:

• TemplateSource

Field	Description	Default	Validation
name string	Name is unique within a namespace to reference a configmap resource.		MaxLength: 253 MinLength: 1 Required: {}
namespace string	Namespace defines the space within which the configmap name must be unique. If omitted, the namespace of the object being reconciled will be used.		MaxLength: 63 MinLength: 1 Optional: {}
key string	Key is the of the entry in the configmap resource's data or binaryData field to be used.		MaxLength: 253 MinLength: 1 Required: {}

ConfigMapReference

ConfigMapReference represents a ConfigMap Reference. It has enough information to retrieve a ConfigMap in any namespace.

Appears in:

• ConfigMapKeySelector

Field	Description	Default	Validation
name string	Name is unique within a namespace to reference a configmap resource.		MaxLength: 253 MinLength: 1 Required: {}
namespace string	Namespace defines the space within which the configmap name must be unique. If omitted, the namespace of the object being reconciled will be used.		MaxLength: 63 MinLength: 1 Optional: {}

ConsoleConnection

ConsoleConnection is the Schema for the consoleconnections API.

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	ConsoleConnection
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ConsoleConnectionSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status ConsoleConnectionStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

ConsoleConnectionSpec

ConsoleConnectionSpec defines the desired state of ConsoleConnection.

Appears in:

• ConsoleConnection

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceRef is a reference to the Device this console connection targets. The Device object must exist in the same namespace. Immutable.		Required: {}
endpoint ConsoleEndpoint	Endpoint contains the console server connection details.		Required: {}
verification ConsoleVerification	Verification configures how the controller confirms the serial line is alive and connected to the expected device.		Optional: {}
schedule string	Schedule is an optional cron expression (e.g., "*/5 * * * *"). If omitted, the controller performs a one-shot check only once for the resource; it does not re-execute on subsequent reconciliations. If set, the controller checks periodically according to the schedule.		Optional: {}
timeout Duration	Timeout is the maximum duration the controller waits for output on the serial line before declaring the connection dead.	30s	Optional: {}

ConsoleConnectionStatus

ConsoleConnectionStatus defines the observed state of ConsoleConnection.

Appears in:

• ConsoleConnection

Field	Description	Default	Validation
lastCheckTime Time	LastCheckTime is the timestamp of the most recent check.		Optional: {}
nextCheckTime Time	NextCheckTime is the next scheduled check. Only set when Schedule is configured.		Optional: {}
conditions Condition array	Conditions represent the current state of the ConsoleConnection resource. The Ready condition reports the health of the console connection.		Optional: {}

ConsoleEndpoint

ConsoleEndpoint contains the console server connection details.

Appears in:

• ConsoleConnectionSpec

Field	Description	Default	Validation
address string	Address is the console server address in IP:Port format. The port identifies the serial line on the console server.		Pattern: ^(\d\{1,3\}\.)\{3\}\d\{1,3\}:\d\{1,5\}$ Required: {}
protocol ConsoleProtocol	Protocol is the connection protocol.	SSH	Enum: [SSH] Optional: {}
secretRef SecretReference	SecretRef references a kubernetes.io/basic-auth secret containing 'username' and 'password' for the console server.		Required: {}

ConsoleExpect

ConsoleExpect configures what the controller looks for in the serial output.

Appears in:

• ConsoleVerification

Field	Description	Default	Validation
string string	String is a literal string to match in the serial output.		Optional: {}
regex string	Regex is a regular expression to match in the serial output.		Optional: {}

ConsoleProtocol

Underlying type: string

ConsoleProtocol is the connection protocol used to reach the console server.

Validation:

• Enum: [SSH]

Appears in:

• ConsoleEndpoint

Field	Description
SSH

ConsoleVerification

ConsoleVerification configures how the controller confirms the serial line is alive and connected to the expected device.

Appears in:

• ConsoleConnectionSpec

Field	Description	Default	Validation
strategy ConsoleVerificationStrategy	Strategy selects how the controller stimulates the serial line. Wait — passively wait for output without sending anything. SendCRLF — send a carriage-return/line-feed to trigger a prompt or response. SendChar — send a single printable character to trigger a response. Defaults to SendCRLF.	SendCRLF	Enum: [Wait SendCRLF SendChar] Optional: {}
char string	Char is the character to send when Strategy is SendChar. Ignored for other strategies.		MaxLength: 1 MinLength: 1 Optional: {}
expect ConsoleExpect	Expect configures what the controller looks for in the serial output. If omitted, the controller matches the device hostname or serial number from Device.Status.		Optional: {}

ConsoleVerificationStrategy

Underlying type: string

ConsoleVerificationStrategy selects how the controller stimulates the serial line.

Validation:

• Enum: [Wait SendCRLF SendChar]

Appears in:

• ConsoleVerification

Field	Description
Wait
SendCRLF
SendChar

ControlProtocol

Appears in:

• Aggregation

Field	Description	Default	Validation
mode LACPMode	Mode defines the LACP mode for the aggregate interface.		Enum: [Active Passive Static] Required: {}

DFElectionMode

Underlying type: string

DFElectionMode defines the Designated Forwarder election algorithm.

Validation:

• Enum: [Default HighestRandomWeight Preference]

Appears in:

• DesignatedForwarder

Field	Description
Default	DFElectionModeDefault uses the modulo-based DF election per RFC 7432 Section 8.5.
HighestRandomWeight	DFElectionModeHighestRandomWeight uses the HRW algorithm per RFC 8584.
Preference	DFElectionModePreference uses preference-based DF election per RFC 8584.

DHCPRelay

DHCPRelay is the Schema for the DHCPRelays API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	DHCPRelay
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DHCPRelaySpec			Required: {}
status DHCPRelayStatus			Optional: {}

DHCPRelaySpec

DHCPRelaySpec defines the desired state of the DHCPRelay configuration for a single interface. The migration path for existing DHCPRelay objects that use the deprecated InterfaceRefs field requires deleting those objects and creating new ones using the new fields. Objects using the deprecated field InterfaceRefs likely replace the entire DHCPRelay tree and thus would remove configuration for all interfaces, even for those that are not referenced.

Appears in:

• DHCPRelay

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceRef is a reference to the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration for this DHCPRelay. If not specified the provider applies the target platform's default settings.		Optional: {}
interfaceRef LocalObjectReference	InterfaceRef is a reference to an interface resource on which to enable DHCP relay. Immutable. To be made non-pointer object and required once we remove the deprecated fields.		Optional: {}
vrfRef LocalObjectReference	VrfRef is an optional reference to the VRF to use when relaying DHCP messages in the referenced interface(s).		Optional: {}
servers string array	Servers is a list of DHCP server addresses to which DHCP messages will be relayed. Only IPv4 addresses are currently supported.		MinItems: 1 items:Format: ipv4 Required: {}
interfaceRefs LocalObjectReference array	Deprecated: Use field InterfaceRef instead.		MinItems: 1 Optional: {}

DHCPRelayStatus

DHCPRelayStatus defines the observed state of DHCPRelay.

Appears in:

• DHCPRelay

Field	Description	Default	Validation
conditions Condition array	conditions represent the current state of the DHCPRelay resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. Standard condition types include: - "Available": the resource is fully functional - "Progressing": the resource is being created or updated - "Degraded": the resource failed to reach or maintain its desired state The status of each condition is one of True, False, or Unknown.		Optional: {}

DNS

DNS is the Schema for the dns API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	DNS
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DNSSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status DNSStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

DNSSpec

DNSSpec defines the desired state of DNS

Appears in:

• DNS

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the DNS to its provider-specific configuration.		Optional: {}
adminState AdminState	AdminState indicates whether DNS is administratively up or down.	Up	Enum: [Up Down] Optional: {}
domain string	Default domain name that the device uses to complete unqualified hostnames.		Format: hostname MaxLength: 253 MinLength: 1 Required: {}
servers NameServer array	A list of DNS servers to use for address resolution.		MaxItems: 6 MinItems: 1 Optional: {}
sourceInterfaceName string	Source interface for all DNS traffic.		MaxLength: 63 MinLength: 1 Optional: {}

DNSStatus

DNSStatus defines the observed state of DNS.

Appears in:

• DNS

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the DNS.		Optional: {}

DesignatedForwarder

DesignatedForwarder configures the DF election parameters for an Ethernet Segment.

Appears in:

• EthernetSegmentSpec

Field	Description	Default	Validation
electionMode DFElectionMode	ElectionMode selects the DF election algorithm.	Default	Enum: [Default HighestRandomWeight Preference] Optional: {}
electionWaitTime Duration	ElectionWaitTime is the DF election hold timer. The PE waits this duration before selecting the DF based on highest preference. Only applicable when ElectionMode is Preference.		Optional: {}

Device

Device is the Schema for the devices API.

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	Device
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec DeviceSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
status DeviceStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

DevicePhase

Underlying type: string

DevicePhase represents the current phase of the Device as it's being provisioned and managed by the operator.

Validation:

• Enum: [Pending Provisioning Running Failed Provisioned]

Appears in:

• DeviceStatus

Field	Description
Pending	DevicePhasePending indicates that the device is pending and has not yet been provisioned.
Provisioning	DevicePhaseProvisioning indicates that the device is being provisioned.
Provisioned	DevicePhaseProvisioned indicates that the device provisioning has completed and the operator is performing post-provisioning tasks.
Running	DevicePhaseRunning indicates that the device has been successfully provisioned and is now ready for use.
Failed	DevicePhaseFailed indicates that the device provisioning has failed.

DevicePort

Appears in:

• DeviceStatus

Field	Description	Default	Validation
name string	Name is the name of the port.		Required: {}
type string	Type is the type of the port, e.g. "10g".		Optional: {}
supportedSpeedsGbps integer array	SupportedSpeedsGbps is the list of supported speeds in Gbps for this port.		Optional: {}
transceiver string	Transceiver is the type of transceiver plugged into the port, if any.		Optional: {}
interfaceName LocalObjectReference	InterfaceRef is the reference to the corresponding Interface resource configuring this port, if any.		Optional: {}

DeviceSpec

DeviceSpec defines the desired state of Device.

Appears in:

• Device

Field	Description	Default	Validation
paused boolean	Paused can be used to prevent controllers from processing the Device and its associated objects.	false	Optional: {}
endpoint Endpoint	Endpoint contains the connection information for the device.		Required: {}
provider string	Provider identifies the provider implementation used to reconcile this Device and all CRDs that reference it. Immutable.		MinLength: 1 Required: {}
provisioning Provisioning	Provisioning is an optional configuration for the device provisioning process. It can be used to provide initial configuration templates or scripts that are applied during the device provisioning.		Optional: {}

DeviceStatus

DeviceStatus defines the observed state of Device.

Appears in:

• Device

Field	Description	Default	Validation
phase DevicePhase	Phase represents the current phase of the Device.	Pending	Enum: [Pending Provisioning Running Failed Provisioned] Required: {}
provider string	Provider is the shortened name of the provider implementation used to reconcile the Device.		Optional: {}
hostname string	Hostname is the hostname of the Device.		Optional: {}
manufacturer string	Manufacturer is the manufacturer of the Device.		Optional: {}
model string	Model is the model identifier of the Device.		Optional: {}
serialNumber string	SerialNumber is the serial number of the Device.		Optional: {}
firmwareVersion string	FirmwareVersion is the firmware version running on the Device.		Optional: {}
lastRebootTime Time	LastRebootTime is the timestamp of the last reboot of the Device, if known.		Optional: {}
provisioning ProvisioningInfo array	Provisioning is the list of provisioning attempts for the Device.		Optional: {}
ports DevicePort array	Ports is the list of ports on the Device.		Optional: {}
portSummary string	PortSummary shows a summary of the port configured, grouped by type, e.g. "1/4 (10g), 3/64 (100g)".		Optional: {}
conditions Condition array	The conditions are a list of status objects that describe the state of the Device.		Optional: {}

ESIType

Underlying type: string

ESIType defines the ESI derivation method per RFC 7432 Section 5.

Validation:

• Enum: [Arbitrary LACP MST MAC RouterID AS]

Appears in:

• EthernetSegmentSpec
• EthernetSegmentStatus

Field	Description
Arbitrary	ESITypeArbitrary indicates an operator-configured ESI value (Type 0).
LACP	ESITypeLACP indicates a LACP-based ESI derived from CE system MAC and port key (Type 1).
MST	ESITypeMST indicates a bridge-protocol-based ESI derived from root bridge parameters (Type 2).
MAC	ESITypeMAC indicates a MAC-based ESI derived from system MAC and local discriminator (Type 3).
RouterID	ESITypeRouterID indicates a router-ID-based ESI (Type 4).
AS	ESITypeAS indicates an AS-number-based ESI (Type 5).

EVPNInstance

EVPNInstance is the Schema for the evpninstances API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	EVPNInstance
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec EVPNInstanceSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status EVPNInstanceStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

EVPNInstanceSpec

EVPNInstanceSpec defines the desired state of EVPNInstance

It models an EVPN instance (EVI) context on a single network device based on VXLAN encapsulation and the VLAN-based service type defined in [RFC 8365]. [RFC 8365]: https://datatracker.ietf.org/doc/html/rfc8365

Appears in:

• EVPNInstance

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the EVPNInstance to its provider-specific configuration.		Optional: {}
vni integer	VNI is the VXLAN Network Identifier. Immutable.		Maximum: 1.6777214e+07 Minimum: 1 Required: {}
type EVPNInstanceType	Type specifies the EVPN instance type. Immutable.		Enum: [Bridged Routed] Required: {}
multicastGroupAddress string	MulticastGroupAddress specifies the IPv4 multicast group address used for BUM (Broadcast, Unknown unicast, Multicast) traffic. The address must be in the valid multicast range (224.0.0.0 - 239.255.255.255).		Format: ipv4 Optional: {}
routeDistinguisher string	RouteDistinguisher is the route distinguisher for the EVI. This field is only applicable when Type is Bridged (MAC-VRF). For Routed type, the route distinguisher is configured on the referenced VRF instead. Set to "Auto" for automatic derivation (equivalent to "rd auto"). Formats supported: - "Auto" (automatic derivation) - Type 0: ASN(0-65535):Number(0-4294967295) - Type 1: IPv4:Number(0-65535) - Type 2: ASN(65536-4294967295):Number(0-65535)		Optional: {}
routeTargets EVPNRouteTarget array	RouteTargets is the list of route targets for the EVI.		MinItems: 1 Optional: {}
vlanRef LocalObjectReference	VLANRef is a reference to a VLAN resource for which this EVPNInstance builds the MAC-VRF. This field is only applicable when Type is Bridged (L2VNI). The VLAN resource must exist in the same namespace. Immutable.		Optional: {}
vrfRef LocalObjectReference	VRFRef is a reference to a VRF resource for which this EVPNInstance provides the L3VNI. This field is only applicable when Type is Routed (L3VNI). The VRF resource must exist in the same namespace. Immutable.		Optional: {}
suppressARP boolean	SuppressARP overrides the NVE-level ARP suppression setting for this VNI. When unset, the NVE-level SuppressARP setting takes precedence.		Optional: {}

EVPNInstanceStatus

EVPNInstanceStatus defines the observed state of EVPNInstance.

Appears in:

• EVPNInstance

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the EVPNInstance.		Optional: {}

EVPNInstanceType

Underlying type: string

EVPNInstanceType defines the type of EVPN instance.

Validation:

• Enum: [Bridged Routed]

Appears in:

• EVPNInstanceSpec

Field	Description
Bridged	EVPNInstanceTypeBridged represents an L2VNI (MAC-VRF) EVPN instance. Corresponds to OpenConfig network-instance type L2VSI.
Routed	EVPNInstanceTypeRouted represents an L3VNI (IP-VRF) EVPN instance. Corresponds to OpenConfig network-instance type L3VRF.

EVPNRouteTarget

Appears in:

• EVPNInstanceSpec

Field	Description	Default	Validation
value string	Value is the route target value, must have the format as RouteDistinguisher.		MinLength: 1 Required: {}
action RouteTargetAction	Action defines whether the route target is imported, exported, or both.		Enum: [Import Export Both] Required: {}

EncapType

Underlying type: string

EncapType represents the encapsulation type used for a subinterface.

Validation:

• Enum: [802.1q 802.1ad]

Appears in:

• Encapsulation

Field	Description
802.1q	EncapsulationTypeDot1Q indicates IEEE 802.1Q encapsulation.
802.1ad	EncapsulationTypeQinQ indicates IEEE 802.1ad encapsulation.

Encapsulation

Encapsulation defines config for an L3 subinterface.

Appears in:

• InterfaceSpec

Field	Description	Default	Validation
type EncapType			Enum: [802.1q 802.1ad] Required: {}
tag integer			Maximum: 4094 Minimum: 1 Optional: {}
innerTag integer	InnerTag specifies the inner VLAN ID for QinQ encapsulation. Only applicable when Type is set to "QinQ".		Maximum: 4094 Minimum: 1 Optional: {}
outerTag integer	OuterTag specifies the outer VLAN ID for QinQ encapsulation. Only applicable when Type is set to "QinQ".		Maximum: 4094 Minimum: 1 Optional: {}

EncryptionAlgorithm

Underlying type: string

EncryptionAlgorithm defines the supported encryption algorithms for remote backups.

Validation:

• Enum: [AES-256-GCM ChaCha20-Poly1305]

Appears in:

• ConfigBackupEncryption
• ConfigBackupRunStatus

Field	Description
AES-256-GCM	EncryptionAES256GCM uses AES-256 in GCM mode. Key must be 32 bytes.
ChaCha20-Poly1305	EncryptionChaCha20Poly1305 uses ChaCha20-Poly1305. Key must be 32 bytes.

Endpoint

Endpoint contains the connection information for the device.

Appears in:

• DeviceSpec

Field	Description	Default	Validation
address string	Address is the management address of the device provided in IP:Port format.		Pattern: ^(\d\{1,3\}\.)\{3\}\d\{1,3\}:\d\{1,5\}$ Required: {}
secretRef SecretReference	SecretRef is name of the authentication secret for the device containing the username and password. The secret must be of type kubernetes.io/basic-auth and as such contain the following keys: 'username' and 'password'.		Optional: {}
tls TLS	Transport credentials for grpc connection to the switch.		Optional: {}

Ethernet

Ethernet defines the ethernet-specific configuration for physical interfaces.

Appears in:

• InterfaceSpec

Field	Description	Default	Validation
fecMode FECMode	FECMode specifies the Forward Error Correction mode for the interface. FEC provides error detection and correction at the physical layer, improving link reliability. When not specified, the FEC mode defaults to "auto" where the device negotiates the appropriate mode.		Enum: [FC RS528 Disabled] Optional: {}

EthernetSegment

EthernetSegment is the Schema for the ethernetsegments API.

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	EthernetSegment
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec EthernetSegmentSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status EthernetSegmentStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

EthernetSegmentSpec

EthernetSegmentSpec defines the desired state of EthernetSegment.

It models an EVPN Ethernet Segment for multihoming as defined in [RFC 7432] Section 5. An Ethernet Segment associates an Aggregate interface with a 10-byte Ethernet Segment Identifier (ESI), enabling multi-homed CE connectivity. [RFC 7432]: https://datatracker.ietf.org/doc/html/rfc7432

Appears in:

• EthernetSegment

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceRef is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this Ethernet Segment.		Optional: {}
interfaceRef LocalObjectReference	InterfaceRef is the name of the Interface this Ethernet Segment is associated with. The Interface must be of type Aggregate and belong to the same Device. Immutable.		Required: {}
esiType ESIType	ESIType selects the ESI derivation method (RFC 7432 Section 5). When Arbitrary (Type 0), ESI must be provided explicitly. When LACP or MST (Types 1, 2), ESI is always auto-derived (ESI field must be omitted). When MAC, RouterID, or AS (Types 3-5), ESI may be explicit or auto-derived.	Arbitrary	Enum: [Arbitrary LACP MST MAC RouterID AS] Required: {}
esi string	ESI is the 10-byte Ethernet Segment Identifier in colon-separated hex notation (e.g., "00:11:22:33:44:55:66:77:88:01"). Must not be all-zeros or all-ones (reserved per RFC 7432). Required when ESIType is Arbitrary. Must be omitted when ESIType is LACP or MST. Optional for MAC, RouterID, and AS types (omit to auto-derive on the device).		Pattern: ^([0-9a-fA-F]\{2\}:)\{9\}[0-9a-fA-F]\{2\}$ Optional: {}
redundancyMode RedundancyMode	RedundancyMode defines the multi-homing forwarding model for this Ethernet Segment as defined in RFC 7432 Section 14.1.	AllActive	Enum: [AllActive SingleActive] Optional: {}
designatedForwarder DesignatedForwarder	DesignatedForwarder configures the Designated Forwarder election for this Ethernet Segment (RFC 7432 Section 8.5, RFC 8584).		Optional: {}

EthernetSegmentStatus

EthernetSegmentStatus defines the observed state of EthernetSegment.

Appears in:

• EthernetSegment

Field	Description	Default	Validation
conditions Condition array			Optional: {}
esi string	ESI is the realized 10-byte Ethernet Segment Identifier on the device, in colon-separated hex notation. Populated from spec or read back from device when auto-generated.		Optional: {}
esiType ESIType	ESIType is the ESI derivation type parsed from the first byte of ESI.		Enum: [Arbitrary LACP MST MAC RouterID AS] Optional: {}

FECMode

Underlying type: string

FECMode represents the Forward Error Correction mode for Ethernet Interfaces.

Validation:

• Enum: [FC RS528 Disabled]

Appears in:

• Ethernet

Field	Description
FC	FECModeFC indicates IEEE 802.3 Clause 74 Fire Code FEC for NRZ modulation (<100G).
RS528	FECModeRS528 indicates IEEE 802.3 Clause 91 Reed-Solomon FEC (528,514) for NRZ modulation.
Disabled	FECModeDisabled indicates FEC is administratively disabled.

GNMI

Appears in:

• GRPC

Field	Description	Default	Validation
maxConcurrentCall integer	The maximum number of concurrent gNMI calls that can be made to the gRPC server on the switch for each VRF. Configure a limit from 1 through 16. The default limit is 8.	8	ExclusiveMaximum: false Maximum: 16 Minimum: 1 Optional: {}
keepAliveTimeout Duration	Configure the keepalive timeout for inactive or unauthorized connections. The gRPC agent is expected to periodically send an empty response to the client, on which the client is expected to respond with an empty request. If the client does not respond within the keepalive timeout, the gRPC agent should close the connection. The default interval value is 10 minutes.	10m	Pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$ Type: string Optional: {}

GRPC

Appears in:

• ManagementAccessSpec

Field	Description	Default	Validation
enabled boolean	Enable or disable the gRPC server on the device. If not specified, the gRPC server is enabled by default.	true	Optional: {}
port integer	The TCP port on which the gRPC server should listen. The range of port-id is from 1024 to 65535. Port 9339 is the default.	9339	ExclusiveMaximum: false Maximum: 65535 Minimum: 1024 Optional: {}
serverName string	Name of the gRPC server instance on the device. If not specified, defaults to "gnmi" on OpenConfig devices. Not supported on Cisco NX-OS devices. Immutable once set.		MaxLength: 63 MinLength: 1 Optional: {}
certificateId string	Name of the certificate that is associated with the gRPC service. The certificate is provisioned through other interfaces on the device, such as e.g. the gNOI certificate management service.		MaxLength: 63 MinLength: 1 Optional: {}
vrfName string	Enable the gRPC agent to accept incoming (dial-in) RPC requests from a given vrf.		MaxLength: 63 MinLength: 1 Optional: {}
gnmi GNMI	Additional gNMI configuration for the gRPC server. This may not be supported by all devices.	{ keepAliveTimeout:10m maxConcurrentCall:8 }	Optional: {}

HostReachabilityType

Underlying type: string

HostReachabilityType defines the method used for host reachability.

Validation:

• Enum: [FloodAndLearn BGP]

Appears in:

• NetworkVirtualizationEdgeSpec

Field	Description
BGP	HostReachabilityTypeBGP uses BGP EVPN control-plane for MAC/IP advertisement.
FloodAndLearn	HostReachabilityTypeFloodAndLearn uses data-plane learning for MAC addresses.

IPAddr

IPAddr represents a single IP address (IPv4 or IPv6).

Validation:

• Format: ip
• Type: string

Appears in:

• IPAddressSpec
• PingProbe

IPPrefix

IPPrefix represents an IP prefix in CIDR notation. It is used to define a range of IP addresses in a network.

Validation:

• Format: cidr
• Type: string

Appears in:

• ACLEntry
• AnycastRendezvousPoint
• IPAddressPoolSpec
• IPPrefixPoolSpec
• IPPrefixSpec
• InterfaceIPv4
• InterfaceIPv6
• MulticastGroups
• PrefixEntry
• RendezvousPoint
• RoutePresenceProbe
• StaticRouteSpec

ISIS

ISIS is the Schema for the isis API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	ISIS
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ISISSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status ISISStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

ISISLevel

Underlying type: string

ISISLevel represents the level of an ISIS instance.

Validation:

• Enum: [Level1 Level2 Level1-2]

Appears in:

• ISISSpec

Field	Description
Level1
Level2
Level1-2

ISISSpec

ISISSpec defines the desired state of ISIS

Appears in:

• ISIS

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the ISIS to its provider-specific configuration.		Optional: {}
adminState AdminState	AdminState indicates whether the ISIS instance is administratively up or down.	Up	Enum: [Up Down] Optional: {}
instance string	Instance is the name of the ISIS instance.		MaxLength: 63 MinLength: 1 Required: {}
networkEntityTitle string	NetworkEntityTitle is the NET of the ISIS instance.		Pattern: ^[a-fA-F0-9]\{2\}(\.[a-fA-F0-9]\{4\})\{3,9\}\.[a-fA-F0-9]\{2\}$ Required: {}
type ISISLevel	Type indicates the level of the ISIS instance.		Enum: [Level1 Level2 Level1-2] Required: {}
overloadBit OverloadBit	OverloadBit indicates the overload bit of the ISIS instance.	Never	Enum: [Always Never OnStartup] Optional: {}
addressFamilies AddressFamily array	AddressFamilies is a list of address families for the ISIS instance.		Enum: [IPv4Unicast IPv6Unicast] MaxItems: 2 MinItems: 1 Required: {}
interfaceRefs LocalObjectReference array	InterfaceRefs is a list of interfaces that are part of the ISIS instance.		Optional: {}

ISISStatus

ISISStatus defines the observed state of ISIS.

Appears in:

• ISIS

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the ISIS.		Optional: {}

Image

Appears in:

• Provisioning

Field	Description	Default	Validation
url string	URL is the location of the image to be used for provisioning.		Required: {}
checksum string	Checksum is the checksum of the image for verification. kubebuilder:validation:MinLength=1		Required: {}
checksumType ChecksumType	ChecksumType is the type of the checksum (e.g., sha256, md5).	MD5	Enum: [SHA256 MD5] Required: {}

IndexRange

IndexRange represents an inclusive range of indices.

Validation:

• Pattern: ^[0-9]+(\.\.[0-9]+)?$
• Type: string
• XIntOrString: {}

Appears in:

• IndexPoolSpec
• Switchport

Interface

Interface is the Schema for the interfaces API.

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	Interface
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec InterfaceSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status InterfaceStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

InterfaceIPv4

InterfaceIPv4 defines the IPv4 configuration for an interface.

Appears in:

• InterfaceSpec

Field	Description	Default	Validation
addresses IPPrefix array	Addresses defines the list of IPv4 addresses assigned to the interface. The first address in the list is considered the primary address, and any additional addresses are considered secondary addresses.		Format: cidr MinItems: 1 Type: string Optional: {}
unnumbered InterfaceIPv4Unnumbered	Unnumbered defines the unnumbered interface configuration. When specified, the interface borrows the IP address from another interface.		Optional: {}
anycastGateway boolean	AnycastGateway enables distributed anycast gateway functionality. When enabled, this interface uses the virtual MAC configured in the device's NVE resource for active-active default gateway redundancy. Only applicable for RoutedVLAN interfaces in EVPN/VXLAN fabrics.	false	Optional: {}

InterfaceIPv4Unnumbered

InterfaceIPv4Unnumbered defines the unnumbered interface configuration. An unnumbered interface borrows the IP address from another interface, allowing the interface to function without its own IP address assignment.

Appears in:

• InterfaceIPv4

Field	Description	Default	Validation
interfaceRef LocalObjectReference	InterfaceRef is a reference to the interface from which to borrow the IP address. The referenced interface must exist and have at least one IPv4 address configured.		Required: {}

InterfaceIPv6

InterfaceIPv6 defines the IPv6 configuration for an interface.

Appears in:

• InterfaceSpec

Field	Description	Default	Validation
addresses IPPrefix array	Addresses defines the list of global unicast IPv6 addresses assigned to the interface. Unlike IPv4, all addresses are equal, there is no primary or secondary distinction. Link-local addresses cannot be assigned here, they are configured through UseLinkLocalOnly.		Format: cidr MinItems: 1 Type: string Optional: {}
useLinkLocalOnly boolean	UseLinkLocalOnly configures the interface to operate with only its automatically generated IPv6 link-local address, without assigning a global address. This is what unnumbered, interface-based BGP peering requires in order to discover neighbours over their link-local address.		Optional: {}

InterfaceSource

InterfaceSource identifies a interface either by literal name or by reference to a managed Interface resource. Exactly one of Name or InterfaceRef must be specified.

Appears in:

• PingProbe

Field	Description	Default	Validation
name string	Name is the literal interface name on the device (e.g., "mgmt0", "Loopback0"). Use this for interfaces that are not managed as Interface resources.		MaxLength: 63 MinLength: 1 Optional: {}
interfaceRef LocalObjectReference	InterfaceRef references a managed Interface resource in the same namespace. The controller resolves the device interface name from this resource.		Optional: {}

InterfaceSpec

InterfaceSpec defines the desired state of Interface.

Appears in:

• Interface

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the Interface to its provider-specific configuration.		Optional: {}
name string	Name is the name of the interface.		MaxLength: 255 MinLength: 1 Required: {}
adminState AdminState	AdminState indicates whether the interface is administratively up or down.	Up	Enum: [Up Down] Optional: {}
description string	Description provides a human-readable description of the interface.		MaxLength: 255 Optional: {}
type InterfaceType	Type indicates the type of the interface.		Enum: [Physical Loopback Aggregate RoutedVLAN Subinterface] Required: {}
mtu integer	MTU (Maximum Transmission Unit) specifies the size of the largest packet that can be sent over the interface.		Maximum: 9216 Minimum: 576 Optional: {}
switchport Switchport	Switchport defines the switchport configuration for the interface. This is only applicable for Ethernet and Aggregate interfaces.		Optional: {}
ipv4 InterfaceIPv4	IPv4 defines the IPv4 configuration for the interface.		Optional: {}
ipv6 InterfaceIPv6	IPv6 defines the IPv6 configuration for the interface.		Optional: {}
aggregation Aggregation	Aggregation defines the aggregation (bundle) configuration for the interface. This is only applicable for interfaces of type Aggregate.		Optional: {}
vlanRef LocalObjectReference	VlanRef is a reference to the VLAN resource that this interface provides routing for. This is only applicable for interfaces of type RoutedVLAN. The referenced VLAN must exist in the same namespace.		Optional: {}
vrfRef LocalObjectReference	VrfRef is a reference to the VRF resource that this interface belongs to. If not specified, the interface will be part of the default VRF. This is only applicable for Layer 3 interfaces. The referenced VRF must exist in the same namespace.		Optional: {}
bfd BFD	BFD defines the Bidirectional Forwarding Detection configuration for the interface. BFD is only applicable for Layer 3 interfaces.		Optional: {}
ethernet Ethernet	Ethernet defines the ethernet-specific configuration for physical interfaces. This configuration is only applicable to Physical interfaces. When omitted, ethernet parameters use their default values (e.g., FEC mode defaults to auto).		Optional: {}
encapsulation Encapsulation	Encapsulation defines the subinterfaces config for an L3 interface.		Optional: {}
parentInterfaceRef LocalObjectReference	ParentInterfaceRef is a reference to the parent interface for this subinterface. Required if the interface type is Subinterface. Must not be set for other interface types.		Optional: {}

InterfaceStatus

InterfaceStatus defines the observed state of Interface.

Appears in:

• Interface

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the Interface.		Optional: {}
memberOf LocalObjectReference	MemberOf references the aggregate interface this interface is a member of, if any. This field only applies to physical interfaces that are part of an aggregate interface.		Optional: {}
neighbors Neighbor array	Neighbors contains a list of neighbor interfaces connected to this interface and discovered with LLDP. If a single interface has multiple neighbor adjacencies, we validate each adjacency against the same one label/annotation.		Optional: {}

InterfaceType

Underlying type: string

InterfaceType represents the type of the interface.

Validation:

• Enum: [Physical Loopback Aggregate RoutedVLAN Subinterface]

Appears in:

• InterfaceSpec

Field	Description
Physical	InterfaceTypePhysical indicates that the interface is a physical/ethernet interface.
Loopback	InterfaceTypeLoopback indicates that the interface is a loopback interface.
Aggregate	InterfaceTypeAggregate indicates that the interface is an aggregate (bundle) interface.
RoutedVLAN	InterfaceTypeRoutedVLAN indicates that the interface is a routed VLAN interface (SVI/IRB).
Subinterface	InterfaceTypeSubinterface indicates that the interface is a subinterface of an interface.

LACPMode

Underlying type: string

LACPMode represents the LACP mode of an interface.

Validation:

• Enum: [Active Passive Static]

Appears in:

• ControlProtocol

Field	Description
Active	LACPModeActive indicates that LACP is in active mode.
Passive	LACPModePassive indicates that LACP is in passive mode.
Static	LACPModeStatic indicates a static port-channel with no LACP (mode on).

LLDP

LLDP is the Schema for the lldps API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	LLDP
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec LLDPSpec			Required: {}
status LLDPStatus			Optional: {}

LLDPInterface

Appears in:

• LLDPSpec

Field	Description	Default	Validation
name string	Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names		MaxLength: 63 MinLength: 1 Required: {}
adminState AdminState	AdminState indicates whether LLDP is administratively up or down on this interface. This will be ignored if LLDP is configured to be administratively down system-wide.	Up	Enum: [Up Down] Optional: {}

LLDPSpec

LLDPSpec defines the desired state of LLDP

Appears in:

• LLDP

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration for this LLDP. If not specified the provider applies the target platform's default settings.		Optional: {}
adminState AdminState	AdminState indicates whether LLDP is system-wide administratively up or down.		Enum: [Up Down] Required: {}
interfaceRefs LLDPInterface array	InterfaceRefs is a list of interfaces and their LLDP configuration. Interfaces not listed here are left at the platform default, which on all supported platforms is LLDP enabled. To disable LLDP on specific interfaces, add them with adminState set to Down.		Optional: {}

LLDPStatus

LLDPStatus defines the observed state of LLDP.

Appears in:

• LLDP

Field	Description	Default	Validation
conditions Condition array	conditions represent the current state of the LLDP resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. Standard condition types include: - "Available": the resource is fully functional - "Progressing": the resource is being created or updated - "Degraded": the resource failed to reach or maintain its desired state The status of each condition is one of True, False, or Unknown.		Optional: {}

LocalAS

LocalAS defines the local AS configuration and how it factors in BGP announcements.

Appears in:

• BGPPeerSpec

Field	Description	Default	Validation
asNumber IntOrString	ASNumber specifies a local AS number to present in BGP sessions with this peer.		Required: {}
prependLocalAS boolean	PrependLocalAS specifies whether to prepend the local AS number to updates received from this peer.	true	Optional: {}
prependGlobalAS boolean	PrependGlobalAS specifies whether to prepend the global AS number to updates sent to this neighbor.	true	Optional: {}

LocalObjectReference

LocalObjectReference contains enough information to locate a referenced object inside the same namespace.

Appears in:

• AAASpec
• AccessControlListSpec
• Aggregation
• BGPPeerAddressFamily
• BGPPeerLocalAddress
• BGPPeerReference
• BGPPeerSpec
• BGPRedistributeDirectRoutes
• BGPSpec
• BannerSpec
• BorderGatewaySpec
• CertificateSpec
• CommunitySetMatchCondition
• CommunitySetSpec
• ConfigBackupSpec
• ConsoleConnectionSpec
• DHCPRelaySpec
• DNSSpec
• DevicePort
• EVPNInstanceSpec
• EthernetSegmentSpec
• FabricLoopbacksSpec
• FabricUnderlayAddressingSpec
• ISISSpec
• InterconnectInterfaceReference
• InterfaceIPv4Unnumbered
• InterfaceSource
• InterfaceSpec
• InterfaceStatus
• KeepAlive
• LLDPInterface
• LLDPSpec
• ManagementAccessSpec
• NTPSpec
• NetworkAttachmentSpec
• NetworkVirtualizationEdgeSpec
• NextHop
• OSPFInterface
• OSPFNeighbor
• OSPFSpec
• PIMInterface
• PIMSpec
• Peer
• PrefixSetMatchCondition
• PrefixSetSpec
• ProbeSpec
• RoutingPolicySpec
• SNMPSpec
• StaticRouteSpec
• SyslogSpec
• SystemSpec
• UserSpec
• VLANSource
• VLANSpec
• VLANStatus
• VPCDomainSpec
• VRFSource
• VRFSpec

Field	Description	Default	Validation
name string	Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names		MaxLength: 63 MinLength: 1 Required: {}

LogFacility

Appears in:

• SyslogSpec

Field	Description	Default	Validation
name string	The name of the log facility.		MaxLength: 63 MinLength: 1 Required: {}
severity Severity	The severity level of the log messages for this facility.		Enum: [Debug Info Notice Warning Error Critical Alert Emergency] Required: {}

LogServer

Appears in:

• SyslogSpec

Field	Description	Default	Validation
address string	IP address or hostname of the remote log server		MaxLength: 253 MinLength: 1 Required: {}
severity Severity	The servity level of the log messages sent to the server.		Enum: [Debug Info Notice Warning Error Critical Alert Emergency] Required: {}
vrfName string	The name of the vrf used to reach the log server.		MaxLength: 63 MinLength: 1 Required: {}
port integer	The destination port number for syslog UDP messages to the server. The default is 514.	514	Optional: {}

MACTableEntryProbe

MACTableEntryProbe asserts that a specific MAC address exists in the device's forwarding table.

Appears in:

• ProbeSpec

Field	Description	Default	Validation
macAddress string	MACAddress is the MAC address to look for in the device's MAC table.		Pattern: ^([0-9a-fA-F]\{2\}:)\{5\}[0-9a-fA-F]\{2\}$ Required: {}
vlan VLANSource	VLAN constrains the lookup to a specific VLAN.		Optional: {}

ManagementAccess

ManagementAccess is the Schema for the managementaccesses API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	ManagementAccess
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ManagementAccessSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status ManagementAccessStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

ManagementAccessSpec

ManagementAccessSpec defines the desired state of ManagementAccess

Appears in:

• ManagementAccess

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the ManagementAccess to its provider-specific configuration.		Optional: {}
grpc GRPC	Configuration for the gRPC server on the device.	{ enabled:true port:9339 }	Optional: {}
ssh SSH	Configuration for the SSH server on the device.	{ enabled:true sessionLimit:32 timeout:10m }	Optional: {}

ManagementAccessStatus

ManagementAccessStatus defines the observed state of ManagementAccess.

Appears in:

• ManagementAccess

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the ManagementAccess.		Optional: {}

MaskLengthRange

Appears in:

• PrefixEntry

Field	Description	Default	Validation
min integer	Minimum mask length.		Maximum: 128 Minimum: 0 Required: {}
max integer	Maximum mask length.		Maximum: 128 Minimum: 0 Required: {}

MatchSetOption

Underlying type: string

MatchSetOption defines how a route's attributes are compared against a referenced set.

Validation:

• Enum: [Any All]

Appears in:

• CommunitySetMatchCondition

Field	Description
Any	MatchSetOptionAny matches a route carrying at least one member of the referenced set.
All	MatchSetOptionAll matches only a route carrying every member of the referenced set.

MultiChassis

Appears in:

• Aggregation

Field	Description	Default	Validation
enabled boolean	Enabled indicates whether the aggregate interface is part of a multichassis setup.	true	Required: {}
id integer	ID is the multichassis identifier.		Maximum: 4094 Minimum: 1 Required: {}

MulticastGroups

MulticastGroups defines multicast group addresses for overlay BUM traffic. Only supports IPv4 multicast addresses.

Appears in:

• NetworkVirtualizationEdgeSpec

Field	Description	Default	Validation
l2 IPPrefix	L2 is the multicast group for Layer 2 VNIs (BUM traffic in bridged VLANs).		Format: cidr Type: string Optional: {}
l3 IPPrefix	L3 is the multicast group for Layer 3 VNIs (BUM traffic in routed VRFs).		Format: cidr Type: string Optional: {}

NTP

NTP is the Schema for the ntp API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	NTP
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec NTPSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status NTPStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

NTPServer

Appears in:

• NTPSpec

Field	Description	Default	Validation
address string	Hostname/IP address of the NTP server.		MaxLength: 253 MinLength: 1 Required: {}
prefer boolean	Indicates whether this server should be preferred or not.	false	Optional: {}
vrfName string	The name of the vrf used to communicate with the NTP server.		MaxLength: 63 MinLength: 1 Optional: {}

NTPSpec

NTPSpec defines the desired state of NTP

Appears in:

• NTP

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the NTP to its provider-specific configuration.		Optional: {}
adminState AdminState	AdminState indicates whether NTP is administratively up or down.	Up	Enum: [Up Down] Optional: {}
sourceInterfaceName string	Source interface for all NTP traffic.		MaxLength: 63 MinLength: 1 Required: {}
servers NTPServer array	NTP servers.		MinItems: 1 Required: {}

NTPStatus

NTPStatus defines the observed state of NTP.

Appears in:

• NTP

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the NTP.		Optional: {}

NameServer

Appears in:

• DNSSpec

Field	Description	Default	Validation
address string	The Hostname or IP address of the DNS server.		MaxLength: 253 MinLength: 1 Required: {}
vrfName string	The name of the vrf used to communicate with the DNS server.		MaxLength: 63 MinLength: 1 Optional: {}

Neighbor

Neighbor represents an LLDP neighbor discovered on an interface. It includes the results of the LLDP adjacency validation against the expected neighbor information from the interface's labels or annotations.

Appears in:

• InterfaceStatus

Field	Description	Default	Validation
chassisId string	ChassisID contains an octet string indicating the specific chassis ID of the neighbor. Its semantics are defined by the ChassisIDType field.		Required: {}
chassisIdType ChassisIDType	ChassisIDType represents the chassis ID subtype. Full list of types can be found in IEEE 802.1AB-2016 Table 8-2.		Enum: [ChassisComponent InterfaceAlias PortComponent MACAddress NetworkAddress InterfaceName Local] Required: {}
portId string	PortID contains an octet string indicating the specific port ID of the neighbor. Its semantics are defined by the PortIDType field.		Required: {}
portIdType PortIDType	PortIDType represents the port ID subtype. Full list of types can be found in IEEE 802.1AB-2016 Table 8-3.		Enum: [InterfaceAlias PortComponent MACAddress NetworkAddress InterfaceName AgentCircuitID Local] Required: {}
systemName string	SystemName is an alpha-numeric string that indicates the system’s administratively assigned name.		Optional: {}
systemDescription string	SystemDescription is a textual description of the neighbor, should include hardware and software information If the device supports IETF RFC 3418, this is the sysDescr		Optional: {}
portDescription string	PortDescription contains the port description of the neighbor port. If the device supports IETF RFC 2863, this is the ifDescr		Optional: {}
expirationTime Time	ExpirationTime is the time when the LLDP neighbor information expires. It is calculated based on the TTL.		Required: {}
validation NeighborValidation	Validation indicates whether the LLDP neighbor information matches the information in the label or annotations of the interface. Empty when no validation source (label or annotation) is configured on the interface.		Enum: [NotFound Verified DeviceMismatch PortMismatch] Optional: {}

NeighborValidation

Underlying type: string

NeighborValidation represents the result of the validation of the LLDP neighbor information against the expected values from the interface's labels or annotations.

Validation:

• Enum: [NotFound Verified DeviceMismatch PortMismatch]

Appears in:

• Neighbor

Field	Description
NotFound	NeighborNotFound indicates that the resource referenced in the PhysicalInterfaceNeighborLabel label could not be found.
Verified	NeighborVerified indicates that the LLDP neighbor information has been verified and matches the expected values.
DeviceMismatch	NeighborDeviceMismatch indicates that the LLDP neighbor information does not match the expected values, indicating a potential misconfiguration or unexpected neighbor.
PortMismatch	NeighborPortMismatch indicates that the LLDP neighbor information does not match the expected port information, indicating a potential misconfiguration or unexpected neighbor.

NetworkVirtualizationEdge

NetworkVirtualizationEdge is the Schema for the networkvirtualizationedges API The NVE resource is the equivalent to an Endpoint for a Network Virtualization Overlay Object in OpenConfig (nvo:Ep).

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	NetworkVirtualizationEdge
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec NetworkVirtualizationEdgeSpec			Required: {}
status NetworkVirtualizationEdgeStatus			Optional: {}

NetworkVirtualizationEdgeSpec

NetworkVirtualizationEdgeSpec defines the desired state of a Network Virtualization Edge (NVE).

Appears in:

• NetworkVirtualizationEdge

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration for this NVE. If not specified the provider applies the target platform's default settings.		Optional: {}
adminState AdminState	AdminState indicates whether the interface is administratively up or down.		Enum: [Up Down] Required: {}
sourceInterfaceRef LocalObjectReference	SourceInterface is the reference to the loopback interface used for the primary NVE IP address.		Required: {}
anycastSourceInterfaceRef LocalObjectReference	AnycastSourceInterfaceRef is the reference to the loopback interface used for anycast NVE IP address.		Optional: {}
suppressARP boolean	SuppressARP indicates whether ARP suppression is enabled for this NVE.	false	Optional: {}
hostReachability HostReachabilityType	HostReachability specifies the method used for host reachability.		Enum: [FloodAndLearn BGP] Required: {}
multicastGroups MulticastGroups	MulticastGroups defines multicast group addresses for BUM traffic.		Optional: {}
anycastGateway AnycastGateway	AnycastGateway defines the distributed anycast gateway configuration. This enables multiple NVEs to share the same gateway IP and MAC for active-active first-hop redundancy.		Optional: {}

NetworkVirtualizationEdgeStatus

NetworkVirtualizationEdgeStatus defines the observed state of the NVE.

Appears in:

• NetworkVirtualizationEdge

Field	Description	Default	Validation
conditions Condition array	conditions represent the current state of the NVE resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. Standard condition types include: - "Available": the resource is fully functional - "Progressing": the resource is being created or updated - "Degraded": the resource failed to reach or maintain its desired state The conditions are a list of status objects that describe the state of the NVE.		Optional: {}
sourceInterfaceName string	SourceInterfaceName is the resolved source interface IP address used for NVE encapsulation.
anycastSourceInterfaceName string	AnycastSourceInterfaceName is the resolved anycast source interface IP address used for NVE encapsulation.
hostReachability string	HostReachability indicates the actual method used for host reachability.

NextHop

Appears in:

• StaticRouteSpec

Field	Description	Default	Validation
interfaceRef LocalObjectReference	InterfaceRef is a reference to the Interface resource that this static route is associated with. The referenced Interface must exist in the same namespace.		Optional: {}
address string	Address is the IP address of the next hop for the static route.		Format: ipv4 Required: {}
metric integer	Metric assigns a priority to the static route. Lower values indicate higher priority.		Optional: {}

OSPF

OSPF is the Schema for the ospf API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	OSPF
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec OSPFSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status OSPFStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

OSPFInterface

OSPFInterface defines the OSPF-specific configuration for an interface that is participating in an OSPF instance.

Appears in:

• OSPFSpec

Field	Description	Default	Validation
name string	Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names		MaxLength: 63 MinLength: 1 Required: {}
area string	Area is the OSPF area identifier for this interface. Must be specified in dotted-quad notation (e.g., "0.0.0.0" for the backbone area). This is semantically a 32-bit identifier displayed in IPv4 address format, not an actual IPv4 address. Area 0 (0.0.0.0) is the OSPF backbone area and is required for proper OSPF operation in multi-area configurations.		Format: ipv4 Required: {}
passive boolean	Passive indicates whether this interface should operate in passive mode. In passive mode, OSPF will advertise the interface's network in LSAs but will not send or receive OSPF protocol packets (Hello, LSU, etc.) on this interface. This is typically used for loopback interfaces where OSPF adjacencies should not be formed but the network should still be advertised. Defaults to false (active mode).		Optional: {}

OSPFNeighbor

OSPFNeighbor represents an OSPF neighbor with its adjacency information.

Appears in:

• OSPFStatus

Field	Description	Default	Validation
routerId string	RouterID is the router identifier of the remote OSPF neighbor.		Required: {}
address string	Address is the IP address of the remote OSPF neighbor.		Required: {}
interfaceRef LocalObjectReference	InterfaceRef is a reference to the local interface through which this neighbor is connected.		Required: {}
priority integer	Priority is the remote system's priority to become the designated router. Valid range is 0-255.		Optional: {}
lastEstablishedTime Time	LastEstablishedTime is the timestamp when the adjacency last transitioned to the FULL state. A frequently changing timestamp indicates adjacency instability (flapping).		Optional: {}
adjacencyState OSPFNeighborState	AdjacencyState is the current state of the adjacency with this neighbor.		Enum: [Down Attempt Init TwoWay ExStart Exchange Loading Full] Optional: {}

OSPFNeighborState

Underlying type: string

OSPFNeighborState represents the state of an OSPF adjacency as defined in RFC 2328.

Validation:

• Enum: [Down Attempt Init TwoWay ExStart Exchange Loading Full]

Appears in:

• OSPFNeighbor

Field	Description
Unknown	OSPFNeighborStateUnknown indicates an unknown or undefined state.
Down	OSPFNeighborStateDown indicates the initial state of a neighbor. No recent information has been received from the neighbor.
Attempt	OSPFNeighborStateAttempt is only valid for neighbors on NBMA networks. It indicates that no recent information has been received but effort should be made to contact the neighbor.
Init	OSPFNeighborStateInit indicates a Hello packet has been received from the neighbor but bidirectional communication has not yet been established.
TwoWay	OSPFNeighborStateTwoWay indicates bidirectional communication has been established. This is the most advanced state short of forming an adjacency.
ExStart	OSPFNeighborStateExStart indicates the first step in creating an adjacency. The routers are determining the relationship and initial DD sequence number.
Exchange	OSPFNeighborStateExchange indicates the routers are exchanging Database Description packets.
Loading	OSPFNeighborStateLoading indicates Link State Request packets are being sent to the neighbor to obtain more recent LSAs that were discovered during the Exchange state.
Full	OSPFNeighborStateFull indicates the neighboring routers are fully adjacent. LSDBs are synchronized and the adjacency will appear in Router and Network LSAs.

OSPFSpec

OSPFSpec defines the desired state of OSPF

Appears in:

• OSPF

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the OSPF to its provider-specific configuration.		Optional: {}
adminState AdminState	AdminState indicates whether the OSPF instance is administratively up or down.	Up	Enum: [Up Down] Optional: {}
instance string	Instance is the process tag of the OSPF instance.		MaxLength: 63 MinLength: 1 Required: {}
routerId string	RouterID is the OSPF router identifier, used in OSPF messages to identify the originating router. Follows dotted quad notation (IPv4 format).		Format: ipv4 Required: {}
logAdjacencyChanges boolean	LogAdjacencyChanges enables logging when the state of an OSPF neighbor changes. When true, a log message is generated for adjacency state transitions.		Optional: {}
interfaceRefs OSPFInterface array	InterfaceRefs is a list of interfaces that are part of the OSPF instance.		MinItems: 1 Optional: {}

OSPFStatus

OSPFStatus defines the observed state of OSPF.

Appears in:

• OSPF

Field	Description	Default	Validation
adjacencySummary string	AdjacencySummary provides a human-readable summary of neighbor adjacencies by state (e.g., "3 Full, 1 ExStart, 1 Down"). This field is computed by the controller from the Neighbors field.		Optional: {}
observedGeneration integer	ObservedGeneration reflects the .metadata.generation that was last processed by the controller.		Optional: {}
neighbors OSPFNeighbor array	Neighbors is a list of OSPF neighbors and their adjacency states.		Optional: {}
conditions Condition array	The conditions are a list of status objects that describe the state of the OSPF.		Optional: {}

OverloadBit

Underlying type: string

OverloadBit represents the overload bit of an ISIS instance.

Validation:

• Enum: [Always Never OnStartup]

Appears in:

• ISISSpec

Field	Description
Always
Never
OnStartup

PIM

PIM is the Schema for the pim API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	PIM
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec PIMSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status PIMStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

PIMInterface

Appears in:

• PIMSpec

Field	Description	Default	Validation
name string	Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names		MaxLength: 63 MinLength: 1 Required: {}
mode PIMInterfaceMode	Mode is the PIM mode to use when delivering multicast traffic via this interface.	Sparse	Enum: [Sparse Dense] Optional: {}

PIMInterfaceMode

Underlying type: string

PIMInterfaceMode represents the mode of a PIM interface.

Validation:

• Enum: [Sparse Dense]

Appears in:

• PIMInterface

Field	Description
Sparse
Dense

PIMSpec

PIMSpec defines the desired state of PIM

Appears in:

• PIM

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the PIM to its provider-specific configuration.		Optional: {}
adminState AdminState	AdminState indicates whether the PIM instance is administratively up or down.	Up	Enum: [Up Down] Optional: {}
rendezvousPoints RendezvousPoint array	RendezvousPoints defines the list of rendezvous points for sparse mode multicast.		MinItems: 1 Optional: {}
interfaceRefs PIMInterface array	InterfaceRefs is a list of interfaces that are part of the PIM instance.		MinItems: 1 Optional: {}

PIMStatus

PIMStatus defines the observed state of PIM.

Appears in:

• PIM

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the PIM.		Optional: {}

PasswordSource

PasswordSource represents a source for the value of a password.

Appears in:

• UserSpec

Field	Description	Default	Validation
secretKeyRef SecretKeySelector	Selects a key of a secret.		Required: {}

PingProbe

PingProbe configures an ICMP echo probe from the device to a target address.

Appears in:

• ProbeSpec

Field	Description	Default	Validation
address IPAddr	Address is the target IPv4 or IPv6 address to ping.		Format: ip Type: string Required: {}
sourceInterface InterfaceSource	SourceInterface selects the source interface for the ping. The provider uses an address on this interface with the same IP family as Address. If omitted, the device selects the source interface automatically.		Optional: {}
vrf VRFSource	VRF selects the VRF context in which to execute the ping. If omitted, the ping is executed in the default/global routing table.		Optional: {}
count integer	Count is the number of ICMP echo requests to send.	3	Maximum: 100 Minimum: 1 Optional: {}
packetSize integer	PacketSize is the ICMP payload size in bytes. Useful for detecting MTU issues in VXLAN overlays.		Maximum: 65507 Minimum: 1 Optional: {}
timeout Duration	Timeout is the maximum time to wait for a reply per echo request.		Optional: {}

PingProbeResult

PingProbeResult contains the result of a Ping probe execution.

Appears in:

• ProbeStatus

Field	Description	Default	Validation
sent integer	Sent is the number of ICMP echo requests sent.		Optional: {}
received integer	Received is the number of ICMP echo replies received.		Optional: {}
minTime Duration	MinTime is the minimum round-trip time.		Optional: {}
avgTime Duration	AvgTime is the average round-trip time.		Optional: {}
maxTime Duration	MaxTime is the maximum round-trip time.		Optional: {}

PolicyActions

PolicyActions defines the actions to take when a policy statement matches.

Appears in:

• PolicyStatement

Field	Description	Default	Validation
routeDisposition RouteDisposition	RouteDisposition specifies whether to accept or reject the route.		Enum: [AcceptRoute RejectRoute] Required: {}
bgpActions BgpActions	BgpActions specifies BGP-specific actions to apply when the route is accepted. Only applicable when RouteDisposition is AcceptRoute.		Optional: {}

PolicyConditions

PolicyConditions defines the match criteria for a policy statement.

Appears in:

• PolicyStatement

Field	Description	Default	Validation
matchPrefixSet PrefixSetMatchCondition	MatchPrefixSet matches routes against a PrefixSet resource.		Optional: {}
matchCommunitySet CommunitySetMatchCondition	MatchCommunitySet matches routes against a CommunitySet resource.		Optional: {}
matchExtendedCommunitySet CommunitySetMatchCondition	MatchExtendedCommunitySet matches routes against a CommunitySet resource of type Extended.		Optional: {}

PolicyStatement

Appears in:

• RoutingPolicySpec

Field	Description	Default	Validation
sequence integer	The sequence number of the policy statement.		Minimum: 1 Required: {}
conditions PolicyConditions	Conditions define the match criteria for this statement. If no conditions are specified, the statement matches all routes.		Optional: {}
actions PolicyActions	Actions define what to do when conditions match.		Required: {}

PortIDType

Underlying type: string

PortIDType represents the port ID subtype for LLDP neighbor information. See IEEE 802.1AB-2016 section 8.5.3.2 for details.

Appears in:

• Neighbor

Field	Description
InterfaceAlias	PortIDTypeInterfaceAlias is ifAlias (IETF RFC 2863)
PortComponent	PortIDTypePortComponent is entPhysicalAlias when entPhysicalClass has a value ‘port(10)’ or ‘backplane(4)’ (IETF RFC 6933)
MACAddress	PortIDTypeMACAddress is the MAC address (IEEE Std 802)
NetworkAddress	PortIDTypeNetworkAddress is an octet string representation of a particular network family and address.
InterfaceName	PortIDTypeInterfaceName is ifName (IETF RFC 2863)
AgentCircuitID	PortIDTypeAgentCircuitID is the agent circuit ID (IETF RFC 3046)
Local	PortIDTypeLocal is an alphanumeric string that and is locally assigned

PrefixEntry

Appears in:

• PrefixSetSpec

Field	Description	Default	Validation
sequence integer	The sequence number of the Prefix entry.		Minimum: 1 Required: {}
prefix IPPrefix	IP prefix. Can be IPv4 or IPv6. Use 0.0.0.0/0 (::/0) to represent 'any'.		Format: cidr Type: string Required: {}
maskLengthRange MaskLengthRange	Optional mask length range for the prefix. If not specified, only the exact prefix length is matched.		Optional: {}

PrefixSet

PrefixSet is the Schema for the prefixsets API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	PrefixSet
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec PrefixSetSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status PrefixSetStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

PrefixSetMatchCondition

PrefixSetMatchCondition defines the condition for matching against a PrefixSet.

Appears in:

• PolicyConditions

Field	Description	Default	Validation
prefixSetRef LocalObjectReference	PrefixSetRef references a PrefixSet in the same namespace. The PrefixSet must exist and belong to the same device.		Required: {}

PrefixSetSpec

PrefixSetSpec defines the desired state of PrefixSet

Appears in:

• PrefixSet

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the PrefixSet to its provider-specific configuration.		Optional: {}
name string	Name is the name of the PrefixSet. Immutable.		MaxLength: 32 MinLength: 1 Required: {}
entries PrefixEntry array	A list of entries to apply. The address families (IPv4, IPv6) of all prefixes in the list must match.		MaxItems: 100 MinItems: 1 Required: {}

PrefixSetStatus

PrefixSetStatus defines the observed state of PrefixSet.

Appears in:

• PrefixSet

Field	Description	Default	Validation
entriesSummary string	EntriesSummary provides a human-readable summary of the number of prefix entries.		Optional: {}
conditions Condition array	The conditions are a list of status objects that describe the state of the PrefixSet.		Optional: {}

Probe

Probe is the Schema for the probes API.

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	Probe
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ProbeSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status ProbeStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

ProbeSpec

ProbeSpec defines the desired state of Probe.

Appears in:

• Probe

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceRef is a reference to the Device this probe targets. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this probe. This reference is used to link the Probe to its provider-specific configuration.		Optional: {}
schedule string	Schedule is an optional cron expression (e.g., "*/5 * * * *"). If omitted, the controller performs a one-shot probe execution only once for the Probe resource; it does not re-execute on subsequent reconciliations. If set, the controller executes the probe periodically according to the schedule.		Optional: {}
type ProbeType	Type selects which probe assertion to execute.		Enum: [Ping MACTableEntry RoutePresence VTEPPeerConnectivity] Required: {}
ping PingProbe	Ping configures an ICMP echo probe. Required when type is Ping, must be omitted otherwise.		Optional: {}
macTableEntry MACTableEntryProbe	MACTableEntry configures a MAC address table lookup probe. Required when type is MACTableEntry, must be omitted otherwise.		Optional: {}
routePresence RoutePresenceProbe	RoutePresence configures a routing table prefix lookup probe. Required when type is RoutePresence, must be omitted otherwise.		Optional: {}
vtepPeerConnectivity VTEPPeerConnectivityProbe	VTEPPeerConnectivity configures a VTEP peer connectivity probe. Required when type is VTEPPeerConnectivity, must be omitted otherwise.		Optional: {}

ProbeStatus

ProbeStatus defines the observed state of Probe.

Appears in:

• Probe

Field	Description	Default	Validation
lastRunTime Time	LastRunTime is the timestamp of the most recent probe execution, regardless of outcome.		Optional: {}
nextRunTime Time	NextRunTime is the next time at which the controller intends to execute the probe. Only set when Schedule is configured.		Optional: {}
ping PingProbeResult	Ping contains the result of the last Ping probe execution. Only set when the probe type is Ping.		Optional: {}
conditions Condition array	Conditions represent the current state of the Probe resource. The Ready condition indicates whether the probe assertion passed (True) or failed (False).		Optional: {}

ProbeType

Underlying type: string

ProbeType selects which assertion a Probe executes.

Validation:

• Enum: [Ping MACTableEntry RoutePresence VTEPPeerConnectivity]

Appears in:

• ProbeSpec

Field	Description
Ping	ProbeTypePing sends ICMP echo requests from the device to a target address.
MACTableEntry	ProbeTypeMACTableEntry asserts that a specific MAC address exists in the device's MAC table.
RoutePresence	ProbeTypeRoutePresence asserts that an IP prefix exists in a routing table.
VTEPPeerConnectivity	ProbeTypeVTEPPeerConnectivity asserts that expected remote VTEP peers are present and up.

Protocol

Underlying type: string

Protocol represents the protocol type for an ACL entry.

Validation:

• Enum: [ICMP IP OSPF PIM TCP UDP]

Appears in:

• ACLEntry

Field	Description
ICMP
IP
OSPF
PIM
TCP
UDP

Provisioning

Provisioning defines the configuration for device bootstrap.

Appears in:

• DeviceSpec

Field	Description	Default	Validation
image Image	Image defines the image to be used for provisioning the device.		Required: {}
bootScript TemplateSource	BootScript defines the script delivered by a TFTP server to the device during bootstrapping.		Optional: {}

ProvisioningInfo

Appears in:

• DeviceStatus

Field	Description	Default	Validation
startTime Time
token string
endTime Time			Optional: {}
reboot Time			Optional: {}
error string			Optional: {}

RedundancyMode

Underlying type: string

RedundancyMode defines the forwarding model for a multi-homed Ethernet Segment.

Validation:

• Enum: [AllActive SingleActive]

Appears in:

• EthernetSegmentSpec

Field	Description
AllActive	RedundancyModeAllActive enables all PE nodes in the segment to forward unicast traffic simultaneously (RFC 7432 Section 14.1.2).
SingleActive	RedundancyModeSingleActive restricts forwarding to the elected Designated Forwarder only (RFC 7432 Section 14.1.1).

RendezvousPoint

Appears in:

• PIMSpec

Field	Description	Default	Validation
address string	Address is the IPv4 address of the rendezvous point.		Format: ipv4 Required: {}
multicastGroups IPPrefix array	MulticastGroups defined the list of multicast IPv4 address ranges associated with the rendezvous point. If not specified, the rendezvous point will be used for all multicast groups.		Format: cidr Type: string Optional: {}
anycastAddresses string array	AnycastAddresses is a list of redundant anycast ipv4 addresses associated with the rendezvous point.		items:Format: ipv4 Optional: {}

RouteDisposition

Underlying type: string

RouteDisposition defines the final disposition of a route.

Validation:

• Enum: [AcceptRoute RejectRoute]

Appears in:

• PolicyActions

Field	Description
AcceptRoute	AcceptRoute permits the route and applies any configured actions.
RejectRoute	RejectRoute denies the route immediately.

RoutePresenceProbe

RoutePresenceProbe asserts that an IP prefix exists in the device's routing table.

Appears in:

• ProbeSpec

Field	Description	Default	Validation
prefix IPPrefix	Prefix is the IP prefix to check for (e.g., "10.100.0.0/16", "2001:db8::/32").		Format: cidr Type: string Required: {}
vrf VRFSource	VRF selects the VRF routing table to check. If omitted, the default/global routing table is checked.		Optional: {}

RouteTarget

Appears in:

• VRFSpec

Field	Description	Default	Validation
value string	Value is the route target value, must have the format as VRFSpec.RouteDistinguisher. Validation via admission webhook.		Required: {}
addressFamilies RouteTargetAF array	AddressFamilies is the list of address families for the route target.		Enum: [IPv4 IPv6 IPv4EVPN IPv6EVPN] MinItems: 1 Required: {}
action RouteTargetAction	Action defines whether the route target is imported, exported, or both		Enum: [Import Export Both] Required: {}

RouteTargetAF

Underlying type: string

RouteTargetAF represents a supported address family value.

Validation:

• Enum: [IPv4 IPv6 IPv4EVPN IPv6EVPN]

Appears in:

• RouteTarget

Field	Description
IPv4
IPv6
IPv4EVPN
IPv6EVPN

RouteTargetAction

Underlying type: string

RouteTargetAction represents the action for a route target.

Validation:

• Enum: [Import Export Both]

Appears in:

• EVPNRouteTarget
• RouteTarget

Field	Description
Import
Export
Both

RoutingPolicy

RoutingPolicy is the Schema for the routingpolicies API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	RoutingPolicy
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec RoutingPolicySpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status RoutingPolicyStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

RoutingPolicySpec

RoutingPolicySpec defines the desired state of RoutingPolicy

Appears in:

• RoutingPolicy

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the RoutingPolicy to its provider-specific configuration.		Optional: {}
name string	Name is the identifier of the RoutingPolicy on the device. Immutable.		MaxLength: 63 MinLength: 1 Required: {}
statements PolicyStatement array	A list of policy statements to apply.		MaxItems: 100 MinItems: 1 Required: {}

RoutingPolicyStatus

RoutingPolicyStatus defines the observed state of RoutingPolicy.

Appears in:

• RoutingPolicy

Field	Description	Default	Validation
statementsSummary string	StatementsSummary provides a human-readable summary of the number of policy statements.		Optional: {}
conditions Condition array	The conditions are a list of status objects that describe the state of the RoutingPolicy.		Optional: {}

SNMP

SNMP is the Schema for the snmp API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	SNMP
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec SNMPSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status SNMPStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

SNMPCommunity

Appears in:

• SNMPSpec

Field	Description	Default	Validation
name string	Name of the community.		MaxLength: 63 MinLength: 1 Required: {}
group string	Group to which the community belongs.		MaxLength: 63 MinLength: 1 Optional: {}
aclName string	ACL name to filter SNMP requests.		MaxLength: 63 MinLength: 1 Optional: {}

SNMPHosts

Appears in:

• SNMPSpec

Field	Description	Default	Validation
address string	The Hostname or IP address of the SNMP host to send notifications to.		MaxLength: 63 MinLength: 1 Required: {}
type string	Type of message to send to host. Default is traps.	Traps	Enum: [Traps Informs] Optional: {}
version string	SNMP version. Default is v2c.	v2c	Enum: [v1 v2c v3] Optional: {}
community string	SNMP community or user name.		MaxLength: 63 MinLength: 1 Optional: {}
vrfName string	The name of the vrf instance to use to source traffic.		MaxLength: 63 MinLength: 1 Optional: {}

SNMPSpec

SNMPSpec defines the desired state of SNMP

Appears in:

• SNMP

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the SNMP to its provider-specific configuration.		Optional: {}
contact string	The contact information for the SNMP server.		MaxLength: 63 MinLength: 1 Optional: {}
location string	The location information for the SNMP server.		MaxLength: 63 MinLength: 1 Optional: {}
sourceInterfaceName string	The name of the interface to be used for sending out SNMP Trap/Inform notifications.		MaxLength: 63 MinLength: 1 Required: {}
communities SNMPCommunity array	SNMP communities for SNMPv1 or SNMPv2c.		MaxItems: 16 MinItems: 1 Optional: {}
hosts SNMPHosts array	SNMP destination hosts for SNMP traps or informs messages.		MaxItems: 16 MinItems: 1 Required: {}
traps string array	The list of trap notifications to enable.		MinItems: 1 Optional: {}
enforceEncryption boolean	EnforceEncryption enforces SNMP message encryption for all users.		Optional: {}

SNMPStatus

SNMPStatus defines the observed state of SNMP.

Appears in:

• SNMP

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the SNMP.		Optional: {}

SSH

Appears in:

• ManagementAccessSpec

Field	Description	Default	Validation
enabled boolean	Enable or disable the SSH server on the device. If not specified, the SSH server is enabled by default.	true	Optional: {}
timeout Duration	The timeout duration for SSH sessions. If not specified, the default timeout is 10 minutes.	10m	Type: string Optional: {}
sessionLimit integer	The maximum number of concurrent SSH sessions allowed. If not specified, the default limit is 32.	32	ExclusiveMaximum: false Maximum: 64 Minimum: 1 Optional: {}

SSHPublicKeySource

SSHPublicKeySource represents a source for the value of an SSH public key.

Appears in:

• UserSpec

Field	Description	Default	Validation
secretKeyRef SecretKeySelector	Selects a key of a secret.		Required: {}

SecretKeySelector

SecretKeySelector contains enough information to select a key of a Secret.

Appears in:

• AAAServerRADIUS
• AAAServerTACACS
• ConfigBackupEncryption
• PasswordSource
• SSHPublicKeySource
• TLS
• TemplateSource

Field	Description	Default	Validation
name string	Name is unique within a namespace to reference a secret resource.		MaxLength: 253 MinLength: 1 Required: {}
namespace string	Namespace defines the space within which the secret name must be unique. If omitted, the namespace of the object being reconciled will be used.		MaxLength: 63 MinLength: 1 Optional: {}
key string	Key is the of the entry in the secret resource's data or stringData field to be used.		MaxLength: 253 MinLength: 1 Required: {}

SecretReference

SecretReference represents a Secret Reference. It has enough information to retrieve a Secret in any namespace.

Appears in:

• CertificateSource
• CertificateSpec
• ConfigBackupS3
• ConsoleEndpoint
• Endpoint
• SecretKeySelector

Field	Description	Default	Validation
name string	Name is unique within a namespace to reference a secret resource.		MaxLength: 253 MinLength: 1 Required: {}
namespace string	Namespace defines the space within which the secret name must be unique. If omitted, the namespace of the object being reconciled will be used.		MaxLength: 63 MinLength: 1 Optional: {}

SetASPathAction

SetASPathAction defines actions to modify the BGP AS path attribute.

Appears in:

• BgpActions

Field	Description	Default	Validation
prepend SetASPathPrepend	Prepend configures prepending to the AS path.		Optional: {}
replace SetASPathReplace	Replace configures replacement of AS numbers in the AS path.		Optional: {}
asNumber IntOrString	ASNumber sets the AS path to the specified AS number. Supports both plain format (1-4294967295) and dotted notation (0-65535.0-65535) as per RFC 5396.		Optional: {}

SetASPathPrepend

SetASPathPrepend configures prepending to the BGP AS path. Either asNumber or useLastAS must be specified, but not both.

Appears in:

• SetASPathAction

Field	Description	Default	Validation
asNumber IntOrString	ASNumber is the autonomous system number to prepend to the AS path. Supports both plain format (1-4294967295) and dotted notation (0-65535.0-65535) as per RFC 5396.		Optional: {}
useLastAS integer	UseLastAS prepends the last AS number in the existing AS path the specified number of times.		Maximum: 10 Minimum: 1 Optional: {}

SetASPathReplace

SetASPathReplace configures replacement of AS numbers in the BGP AS path. Either privateAS or asNumber must be specified, but not both.

Appears in:

• SetASPathAction

Field	Description	Default	Validation
privateAS boolean	PrivateAS, when set to true, targets all private AS numbers in the path for replacement.		Optional: {}
asNumber IntOrString	ASNumber targets a specific AS number in the path for replacement. Supports both plain format (1-4294967295) and dotted notation (0-65535.0-65535) as per RFC 5396.		Optional: {}
replacement IntOrString	Replacement is the AS number to substitute in place of matched AS numbers. Supports both plain format (1-4294967295) and dotted notation (0-65535.0-65535) as per RFC 5396.		Required: {}

SetCommunityAction

SetCommunityAction defines the action to set BGP standard communities.

Appears in:

• BgpActions

Field	Description	Default	Validation
communities string array	Communities is the list of BGP standard communities to set. The communities must be in the format defined by [RFC 1997]. [RFC 1997]: https://datatracker.ietf.org/doc/html/rfc1997		MinItems: 1 Required: {}
operation CommunityOperation	Operation controls whether attributes are added (Add) to the communities or if the communities attributes are replaced (Replace).	Replace	Enum: [Add Replace] Optional: {}

SetExtCommunityAction

SetExtCommunityAction defines the action to set BGP extended communities.

Appears in:

• BgpActions

Field	Description	Default	Validation
communities string array	Communities is the list of BGP extended communities to set. The communities must be in the format defined by [RFC 4360]. [RFC 4360]: https://datatracker.ietf.org/doc/html/rfc4360		MinItems: 1 Required: {}
operation CommunityOperation	Operation controls whether the communities are added to the route's existing communities (Add) or replace them (Replace).	Replace	Enum: [Add Replace] Optional: {}

Severity

Underlying type: string

Severity represents the severity level of a log message.

Validation:

• Enum: [Debug Info Notice Warning Error Critical Alert Emergency]

Appears in:

• LogFacility
• LogServer

Field	Description
Debug
Info
Notice
Warning
Error
Critical
Alert
Emergency

StaticRoute

StaticRoute is the Schema for the staticroutes API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	StaticRoute
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.		Optional: {}
spec StaticRouteSpec	spec defines the desired state of StaticRoute		Required: {}
status StaticRouteStatus	status defines the observed state of StaticRoute		Optional: {}

StaticRouteSpec

StaticRouteSpec defines the desired state of StaticRoute Static routes are used to define explicit paths for network traffic. They can be categorized into different types based on their characteristics and use cases: Directly Connected Routes: Only output interfaces are specified, and the next hop is directly reachable through those interfaces. Recursive Static Routes: In a recursive static route, only the next hop is specified. The output interface is derived from the next hop. Fully Specified Static Routes: Specifies both the output interfaces and the next hop, providing a complete path for the traffic. Floating Static Routes: These routes have a higher administrative distance than dynamic routes, allowing them to serve as backup routes that are only used when the primary route is unavailable.

Appears in:

• StaticRoute

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this StaticRoute. This reference is used to link the StaticRoute to its provider-specific configuration.		Optional: {}
vrfRef LocalObjectReference	VrfRef is a reference to the VRF resource that this static route belongs to. If not specified, the static route will be part of the default VRF. The referenced VRF must exist in the same namespace.		Optional: {}
prefix IPPrefix	IPPrefix is the destination IP prefix for the static route. Immutable.		Format: cidr Type: string Required: {}
nextHops NextHop array	NextHops is a list of next hop objects for the prefix.		MinItems: 1 Required: {}

StaticRouteStatus

StaticRouteStatus defines the observed state of StaticRoute.

Appears in:

• StaticRoute

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the StaticRoute.		Optional: {}

Switchport

Switchport defines the switchport configuration for an interface.

Appears in:

• InterfaceSpec

Field	Description	Default	Validation
mode SwitchportMode	Mode defines the switchport mode, such as access or trunk.		Enum: [Access Trunk] Required: {}
accessVlan integer	AccessVlan specifies the VLAN ID for access mode switchports. Only applicable when Mode is set to "Access".		Maximum: 4094 Minimum: 1 Optional: {}
nativeVlan integer	NativeVlan specifies the native VLAN ID for trunk mode switchports. Only applicable when Mode is set to "Trunk".		Maximum: 4094 Minimum: 1 Optional: {}
allowedVlansMode AllowedVlansMode	AllowedVlansMode defines how trunk allowed VLANs are managed. When omitted, the mode is Exact. Exact means the operator owns the complete allowed VLAN list. Unmanaged means the operator does not change the allowed VLAN list. Only applicable when Mode is set to "Trunk".	Exact	Enum: [Exact Unmanaged] Optional: {}
allowedVlans IndexRange array	AllowedVlans is the exact list of VLAN ID ranges allowed on the trunk port. Each entry is an inclusive range string like "100..200". For compatibility, a single integer like 100 is also accepted and treated as "100..100". If not specified and AllowedVlansMode is Exact, all VLANs (1-4094) are allowed. Must be omitted when AllowedVlansMode is Unmanaged. Only applicable when Mode is set to "Trunk".		MinItems: 1 Pattern: ^[0-9]+(\.\.[0-9]+)?$ Type: string XIntOrString: {} Optional: {}

SwitchportMode

Underlying type: string

SwitchportMode represents the switchport mode of an interface.

Validation:

• Enum: [Access Trunk]

Appears in:

• Switchport

Field	Description
Access	SwitchportModeAccess indicates that the switchport is in access mode.
Trunk	SwitchportModeTrunk indicates that the switchport is in trunk mode.

Syslog

Syslog is the Schema for the syslogs API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	Syslog
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec SyslogSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status SyslogStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

SyslogSpec

SyslogSpec defines the desired state of Syslog

Appears in:

• Syslog

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the Syslog to its provider-specific configuration.		Optional: {}
servers LogServer array	Servers is a list of remote log servers to which the device will send logs.		MaxItems: 16 MinItems: 1 Required: {}
facilities LogFacility array	Facilities is a list of log facilities to configure on the device.		MaxItems: 64 MinItems: 1 Required: {}

SyslogStatus

SyslogStatus defines the observed state of Syslog.

Appears in:

• Syslog

Field	Description	Default	Validation
serversSummary string	ServersSummary provides a human-readable summary of the number of log servers.		Optional: {}
conditions Condition array	The conditions are a list of status objects that describe the state of the Banner.		Optional: {}

TLS

Appears in:

• Endpoint

Field	Description	Default	Validation
ca SecretKeySelector	The CA certificate to verify the server's identity.		Required: {}
certificate CertificateSource	The client certificate and private key to use for mutual TLS authentication. Leave empty if mTLS is not desired.		Optional: {}

TemplateSource

TemplateSource defines a source for template content. It can be provided inline, or as a reference to a Secret or ConfigMap.

Appears in:

• BannerSpec
• Provisioning

Field	Description	Default	Validation
inline string	Inline template content		MinLength: 1 Optional: {}
secretRef SecretKeySelector	Reference to a Secret containing the template		Optional: {}
configMapRef ConfigMapKeySelector	Reference to a ConfigMap containing the template		Optional: {}

TypedLocalObjectReference

TypedLocalObjectReference contains enough information to locate a typed referenced object inside the same namespace.

Appears in:

• AAASpec
• AccessControlListSpec
• BGPPeerSpec
• BGPSpec
• BannerSpec
• CertificateSpec
• ClaimSpec
• ClaimStatus
• CommunitySetSpec
• ConfigBackupSpec
• DHCPRelaySpec
• DNSSpec
• EVPNInstanceSpec
• EthernetSegmentSpec
• FabricSpec
• IPAddressSpec
• IPPrefixSpec
• ISISSpec
• IndexSpec
• InterfaceSpec
• LLDPSpec
• ManagementAccessSpec
• NTPSpec
• NetworkVirtualizationEdgeSpec
• OSPFSpec
• PIMSpec
• PrefixSetSpec
• ProbeSpec
• RoutingPolicySpec
• SNMPSpec
• StaticRouteSpec
• SyslogSpec
• UserSpec
• VLANSpec
• VRFSpec

Field	Description	Default	Validation
kind string	Kind of the resource being referenced. Kind must consist of alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character.		MaxLength: 63 MinLength: 1 Pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ Required: {}
name string	Name of the resource being referenced. Name must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character.		MaxLength: 253 MinLength: 1 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ Required: {}
apiVersion string	APIVersion is the api group version of the resource being referenced.		MaxLength: 253 MinLength: 1 Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/)?([a-z0-9]([-a-z0-9]*[a-z0-9])?)$ Required: {}

User

User is the Schema for the users API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	User
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec UserSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status UserStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

UserRole

UserRole represents a role that can be assigned to a user.

Appears in:

• UserSpec

Field	Description	Default	Validation
name string	The name of the role.		MaxLength: 63 MinLength: 1 Required: {}

UserSpec

UserSpec defines the desired state of User

Appears in:

• User

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the User to its provider-specific configuration.		Optional: {}
username string	Assigned username for this user. Immutable.		MaxLength: 63 MinLength: 1 Required: {}
password PasswordSource	The user password, supplied in cleartext.		Required: {}
roles UserRole array	Role which the user is to be assigned to.		MaxItems: 64 MinItems: 1 Required: {}
sshPublicKey SSHPublicKeySource	SSH public key for this user.		Optional: {}

UserStatus

UserStatus defines the observed state of User.

Appears in:

• User

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the User.		Optional: {}

VLAN

VLAN is the Schema for the vlans API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	VLAN
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec VLANSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status VLANStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

VLANSource

VLANSource identifies a VLAN either by literal ID or by reference to a managed VLAN resource. Exactly one of ID or VLANRef must be specified.

Appears in:

• MACTableEntryProbe

Field	Description	Default	Validation
id integer	ID is the literal VLAN ID on the device (1-4094). Use this for VLANs that are not managed as VLAN resources.		Maximum: 4094 Minimum: 1 Optional: {}
vlanRef LocalObjectReference	VLANRef references a managed VLAN resource in the same namespace. The controller resolves the VLAN ID from this resource.		Optional: {}

VLANSpec

VLANSpec defines the desired state of VLAN

Appears in:

• VLAN

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this vlan. This reference is used to link the VLAN to its provider-specific configuration.		Optional: {}
id integer	ID is the VLAN ID. Valid values are between 1 and 4095. Immutable.		Maximum: 4095 Minimum: 1 Required: {}
name string	Name is the name of the VLAN.		MaxLength: 128 MinLength: 1 Pattern: ^[^\s]+$ Optional: {}
adminState AdminState	AdminState indicates whether the VLAN is administratively active or inactive/suspended.	Up	Enum: [Up Down] Optional: {}

VLANStatus

VLANStatus defines the observed state of VLAN.

Appears in:

• VLAN

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the VLAN.		Optional: {}
routedBy LocalObjectReference	RoutedBy references the interface that provides Layer 3 routing for this VLAN, if any. This field is set when an Interface of type RoutedVLAN references this VLAN.		Optional: {}
bridgedBy LocalObjectReference	BridgedBy references the EVPNInstance that provides a L2VNI for this VLAN, if any. This field is set when an EVPNInstance of type Bridged references this VLAN.		Optional: {}

VRF

VRF is the Schema for the vrfs API

Field	Description	Default	Validation
apiVersion string	networking.metal.ironcore.dev/v1alpha1
kind string	VRF
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec VRFSpec	spec defines the desired state of VRF More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status VRFStatus	status of the resource. This is set and updated automatically. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

VRFSource

VRFSource identifies a VRF/NetworkIntance either by literal name or by reference to a managed VRF resource. Exactly one of Name or VRFRef must be specified.

Appears in:

• PingProbe
• RoutePresenceProbe

Field	Description	Default	Validation
name string	Name is the literal VRF name on the device (e.g., "management", "default"). Use this for VRFs that are not managed as VRF resources.		MaxLength: 63 MinLength: 1 Optional: {}
vrfRef LocalObjectReference	VRFRef references a managed VRF resource in the same namespace. The controller resolves the device VRF name from this resource.		Optional: {}

VRFSpec

VRFSpec defines the desired state of VRF

Appears in:

• VRF

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
providerConfigRef TypedLocalObjectReference	ProviderConfigRef is a reference to a resource holding the provider-specific configuration of this interface. This reference is used to link the VRF to its provider-specific configuration.		Optional: {}
name string	Name is the name of the VRF. Immutable.		MaxLength: 32 MinLength: 1 Required: {}
description string	Description provides a human-readable description of the VRF.		MaxLength: 255 MinLength: 1 Optional: {}
vni integer	VNI is the VXLAN Network Identifier for the VRF (always an L3). Deprecated: Use the VNI field on the EVPNInstance resource instead. This field will be removed in a future release.		Maximum: 1.6777215e+07 Minimum: 1 Optional: {}
routeDistinguisher string	RouteDistinguisher is the route distinguisher for the VRF. Set to "Auto" for automatic derivation (equivalent to "rd auto"). Formats supported: - "Auto" (automatic derivation) - Type 0: ASN(0-65535):Number(0-4294967295) - Type 1: IPv4:Number(0-65535) - Type 2: ASN(65536-4294967295):Number(0-65535) Validation via admission webhook for the VRF type.		Optional: {}
routeTargets RouteTarget array	RouteTargets is the list of route targets for the VRF.		Optional: {}

VRFStatus

VRFStatus defines the observed state of VRF.

Appears in:

• VRF

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the VRF.		Optional: {}

VTEPPeerConnectivityProbe

VTEPPeerConnectivityProbe asserts that expected remote VTEP peers are present and operationally up.

Appears in:

• ProbeSpec

Field	Description	Default	Validation
expectedPeers string array	ExpectedPeers lists remote VTEP IP addresses that must be present and up on the device.		MaxItems: 256 MinItems: 1 Required: {}

nx.cisco.networking.metal.ironcore.dev/v1alpha1

Package v1alpha1 contains API Schema definitions for the nx.cisco.networking.metal.ironcore.dev v1alpha1 API group.

Resource Types

• AAAConfig
• BGPConfig
• BorderGateway
• EVPNInstanceConfig
• EthernetSegmentConfig
• InterfaceConfig
• LLDPConfig
• ManagementAccessConfig
• NetworkVirtualizationEdgeConfig
• PIMConfig
• System
• VPCDomain

AAAConfig

AAAConfig is the Schema for the aaaconfigs API

Field	Description	Default	Validation
apiVersion string	nx.cisco.networking.metal.ironcore.dev/v1alpha1
kind string	AAAConfig
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec AAAConfigSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}

AAAConfigSpec

AAAConfigSpec defines the desired state of AAAConfig

Appears in:

• AAAConfig

Field	Description	Default	Validation
loginErrorEnable boolean	LoginErrorEnable enables login error messages.		Optional: {}
keyEncryption TACACSKeyEncryption	KeyEncryption specifies the default encryption type for TACACS+ keys.	Type7	Enum: [Type6 Type7 Clear]
radiusKeyEncryption RADIUSKeyEncryption	RADIUSKeyEncryption specifies the default encryption type for RADIUS server keys.	Type7	Enum: [Type6 Type7 Clear]

AutoRecovery

AutoRecovery holds settings to automatically restore vPC domain's operation after detecting that the peer is no longer reachable via the keepalive link.

Appears in:

• Peer

Field	Description	Default	Validation
enabled boolean	Enabled indicates whether auto-recovery is enabled. When enabled, the switch will wait for ReloadDelay seconds after peer failure before assuming the peer is dead and restoring the vPC's domain functionality.		Required: {}
reloadDelay integer	ReloadDelay is the time in seconds (60-3600) to wait before assuming the peer is dead and automatically attempting to restore the communication with the peer.	240	Maximum: 3600 Minimum: 60 Optional: {}

BGPConfig

BGPConfig is the Schema for the bgpconfigs API

Field	Description	Default	Validation
apiVersion string	nx.cisco.networking.metal.ironcore.dev/v1alpha1
kind string	BGPConfig
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec BGPConfigSpec	spec defines the desired state of BGPConfig		Required: {}

BGPConfigAddressFamilies

BGPConfigAddressFamilies defines the Cisco NX-OS specific configuration for supported BGP address families.

Appears in:

• BGPConfigSpec

Field	Description	Default	Validation
l2vpnEvpn BGPL2vpnEvpn	L2vpnEvpn configures L2VPN EVPN address family support.		Optional: {}
ipv4Unicast BGPConfigUnicastAddressFamily	Ipv4Unicast configures specific IPv4 unicast address family settings.		Optional: {}
ipv6Unicast BGPConfigUnicastAddressFamily	Ipv6Unicast configures specific IPv6 unicast address family settings.		Optional: {}

BGPConfigSpec

BGPConfigSpec defines the Cisco NX-OS specific BGP configuration.

Appears in:

• BGPConfig

Field	Description	Default	Validation
addressFamilies BGPConfigAddressFamilies	AddressFamilies configures supported BGP address families and their Cisco NX-OS specific settings.		Optional: {}

BGPConfigUnicastAddressFamily

BGPConfigUnicastAddressFamily defines specific configuration shared across unicast BGP address families.

Appears in:

• BGPConfigAddressFamilies

Field	Description	Default	Validation
exportGatewayIP boolean	ExportGatewayIP enables advertising the gateway IP in EVPN Type-5 routes, required for symmetric IRB in VXLAN BGP EVPN topologies.		Optional: {}
advertiseL2vpnEvpn boolean	AdvertiseL2vpnEvpn enables advertising EVPN routes within the VRF unicast address family. Required on border gateway nodes for cross-site EVPN Type-5 IP prefix route advertisement.		Optional: {}

BGPL2vpnEvpn

BGPL2vpnEvpn defines the configuration for L2VPN EVPN address family.

Appears in:

• BGPConfigAddressFamilies

Field	Description	Default	Validation
advertisePIP boolean	AdvertisePIP controls whether the BGP EVPN address-family should advertise the primary IP address (PIP) as the next-hop when advertising prefix routes or loopback interface routes in BGP on vPC enabled leaf or border leaf switches.	false	Optional: {}

BGPPeerReference

BGPPeerReference defines a BGP peer used for border gateway with peer type configuration.

Appears in:

• BorderGatewaySpec

Field	Description	Default	Validation
name string	Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names		MaxLength: 63 MinLength: 1 Required: {}
peerType BGPPeerType	PeerType specifies the role of this BGP peer in the EVPN multisite topology. FabricExternal is used for peers outside the fabric, while FabricBorderLeaf is used for border leaf peers within the fabric.		Enum: [FabricExternal FabricBorderLeaf] Required: {}

BGPPeerType

Underlying type: string

BGPPeerType defines the peer type for border gateway BGP peers.

Validation:

• Enum: [FabricExternal FabricBorderLeaf]

Appears in:

• BGPPeerReference

Field	Description
FabricExternal	BGPPeerTypeFabricExternal represents a BGP peer outside the fabric. Used for external peers in EVPN multisite configurations.
FabricBorderLeaf	BGPPeerTypeFabricBorderLeaf represents a BGP peer that is a border leaf within the fabric. Used for border leaf peers in EVPN multisite configurations.

BorderGateway

BorderGateway is the Schema for the bordergateways API

Field	Description	Default	Validation
apiVersion string	nx.cisco.networking.metal.ironcore.dev/v1alpha1
kind string	BorderGateway
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec BorderGatewaySpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status BorderGatewayStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

BorderGatewaySpec

BorderGatewaySpec defines the desired state of BorderGateway

Appears in:

• BorderGateway

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
adminState AdminState	AdminState indicates whether the BorderGateway instance is administratively up or down.	Up	Enum: [Up Down] Optional: {}
multisiteId integer	MultisiteID is the identifier for the multisite border gateway.		ExclusiveMaximum: false Maximum: 2.81474976710655e+14 Minimum: 1 Required: {}
sourceInterfaceRef LocalObjectReference	SourceInterfaceRef is a reference to the loopback interface used as the source for the border gateway virtual IP address. A best practice is to use a separate loopback address for the NVE source interface and multi-site source interface. The loopback interface must be configured with a /32 IPv4 address. This /32 IP address needs be known by the transient devices in the transport network and the remote VTEPs.		Required: {}
delayRestoreTime Duration	DelayRestoreTime specifies the time to wait before restoring EVPN multisite border gateway functionality after a failure. This allows time for the network to stabilize before resuming traffic forwarding across sites.	180s	Pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$ Type: string Optional: {}
interconnectInterfaceRefs InterconnectInterfaceReference array	InterconnectInterfaceRefs is a list of interfaces that provide connectivity to the border gateway. Each interface can be configured with object tracking to monitor its availability.		MinItems: 1 Optional: {}
bgpPeerRefs BGPPeerReference array	BGPPeerRefs is a list of BGP peers that are part of the border gateway configuration. Each peer can be configured with a peer type to specify its role in the EVPN multisite topology.		MinItems: 1 Optional: {}
stormControl StormControl array	StormControl is the storm control configuration for the border gateway, allowing to rate-limit BUM (Broadcast, Unknown unicast, Multicast) traffic on the border gateway interface.		MinItems: 1 Optional: {}

BorderGatewayStatus

BorderGatewayStatus defines the observed state of BorderGateway.

Appears in:

• BorderGateway

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the Banner.		Optional: {}

BufferBoost

BufferBoost defines the buffer boost configuration for an interface.

Appears in:

• InterfaceConfigSpec

Field	Description	Default	Validation
enabled boolean	Enabled indicates whether buffer boost is enabled on the interface. Maps to CLI command: hardware profile buffer boost		Required: {}

Console

Console defines the configuration for the terminal console access on the device.

Appears in:

• ManagementAccessConfigSpec

Field	Description	Default	Validation
timeout Duration	Timeout defines the inactivity timeout for console sessions. If a session is inactive for the specified duration, it will be automatically disconnected. The format is a string representing a duration (e.g., "10m" for 10 minutes).	10m	Pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$ Type: string Optional: {}

DHCP

DHCP groups DHCP-related system settings. These require the dhcp feature, which the operator enables automatically when a setting here is active.

Appears in:

• SystemSpec

Field	Description	Default	Validation
relayServerIdOverrideDisable boolean	RelayServerIDOverrideDisable enables the global command "ip dhcp relay information option server-id-override-disable". It prevents the DHCP relay agent from overriding the Server-ID (Option 54) in relayed requests, which otherwise causes DHCP servers to drop the request. Disabled by default. Enabling it activates the dhcp feature automatically.	false	Optional: {}

EVPNInstanceConfig

EVPNInstanceConfig is the Schema for the evpninstanceconfigs API

Field	Description	Default	Validation
apiVersion string	nx.cisco.networking.metal.ironcore.dev/v1alpha1
kind string	EVPNInstanceConfig
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec EVPNInstanceConfigSpec	spec defines the desired state of the EVPNInstanceConfig		Required: {}

EVPNInstanceConfigSpec

EVPNInstanceConfigSpec defines the Cisco NX-OS-specific configuration of an EVPNInstance.

Appears in:

• EVPNInstanceConfig

Field	Description	Default	Validation
multisiteIngressReplication MultisiteIngReplMode	MultisiteIngressReplication controls per-VNI multisite ingress replication. When enabled, BUM traffic for this VNI is replicated to remote VTEP peers in the multisite domain via ingress replication. Typically used on Border Gateway (BGW) nodes.	Disabled	Enum: [Disabled Enabled EnabledOptimized] Optional: {}

EVPNMultihoming

EVPNMultihoming defines EVPN ESI multihoming settings for an interface.

Appears in:

• InterfaceConfigSpec

Field	Description	Default	Validation
coreTracking boolean	CoreTracking enables core-link tracking on the interface. When enabled on uplink (core) interfaces, the switch shuts down ESI-attached access links if all tracked core-links go down, preventing traffic blackholing.		Required: {}

Enabled

Enabled represents a simple enabled/disabled configuration.

Appears in:

• Peer
• VPCDomainSpec

Field	Description	Default	Validation
enabled boolean	Enabled indicates whether a configuration property is administratively enabled (true) or disabled (false).		Required: {}

EthernetSegmentConfig

EthernetSegmentConfig is the Schema for the ethernetsegmentconfigs API

Field	Description	Default	Validation
apiVersion string	nx.cisco.networking.metal.ironcore.dev/v1alpha1
kind string	EthernetSegmentConfig
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec EthernetSegmentConfigSpec	spec defines the desired state of the EthernetSegmentConfig		Required: {}

EthernetSegmentConfigSpec

EthernetSegmentConfigSpec defines the Cisco NX-OS-specific configuration of an EthernetSegment.

Appears in:

• EthernetSegmentConfig

Field	Description	Default	Validation
frrAnycastSourceIP string	FRRAnycastSourceIP sets the EVPN ES fast-reroute anycast source IP (evpn esi multihoming / frr-anycast-src-ip). It is applied to the device-global EVPN multihoming configuration. Omit to leave it unmanaged.		Format: ip Optional: {}

InterconnectInterfaceReference

InterconnectInterfaceReference defines an interface used for border gateway interconnectivity with optional object tracking configuration.

Appears in:

• BorderGatewaySpec

Field	Description	Default	Validation
name string	Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names		MaxLength: 63 MinLength: 1 Required: {}
tracking InterconnectTrackingType	Tracking specifies the EVPN multisite tracking mode for this interconnect interface.		Enum: [DataCenterInterconnect Fabric] Required: {}

InterconnectTrackingType

Underlying type: string

InterconnectTrackingType defines the tracking mode for border gateway interconnect interfaces.

Validation:

• Enum: [DataCenterInterconnect Fabric]

Appears in:

• InterconnectInterfaceReference

Field	Description
DataCenterInterconnect	InterconnectTrackingTypeDCI represents Data Center Interconnect tracking mode. Used for interfaces connecting to remote data centers.
Fabric	InterconnectTrackingTypeFabric represents Fabric tracking mode. Used for interfaces connecting to the local fabric.

InterfaceConfig

InterfaceConfig is the Schema for the interfaceconfigs API

Field	Description	Default	Validation
apiVersion string	nx.cisco.networking.metal.ironcore.dev/v1alpha1
kind string	InterfaceConfig
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec InterfaceConfigSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}

InterfaceConfigIPv6

InterfaceConfigIPv6 defines IPv6 settings for an interface.

Appears in:

• InterfaceConfigSpec

Field	Description	Default	Validation
suppressRouterAdvertisement boolean	SuppressRouterAdvertisement stops the interface from sending IPv6 Router Advertisements. NX-OS sends them by default. Neighbours that discover each other over their link-local addresses, such as unnumbered BGP peers, depend on them, so this must stay disabled for such interfaces. Only applied to interfaces that carry IPv6 configuration. Maps to CLI command: ipv6 nd suppress-ra	false	Optional: {}
routerAdvertisementInterval Duration	RouterAdvertisementInterval is the maximum interval between periodic IPv6 Router Advertisements, between 4s and 30m in whole seconds. The minimum interval is derived from it the way NX-OS does for the CLI command: a third of this value, but no less than 3s. Unnumbered BGP peers only discover each other once an advertisement is received, so a short interval speeds up session establishment. If not specified, the interface is reset to the NX-OS default of 600s. Maps to CLI command: ipv6 nd ra-interval		Pattern: ^([0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+$ Type: string Optional: {}

InterfaceConfigLACP

InterfaceConfigLACP defines LACP options for PortChannel interfaces.

Appears in:

• InterfaceConfigSpec

Field	Description	Default	Validation
vpcConvergence boolean	VPCConvergence enables faster LACP convergence in a vPC topology.		Optional: {}
suspendIndividual boolean	SuspendIndividual controls whether a member port is suspended when LACP PDUs are not received. Set to false to keep the port forwarding.		Optional: {}

InterfaceConfigSpec

InterfaceConfigSpec defines the desired state of InterfaceConfig

Appears in:

• InterfaceConfig

Field	Description	Default	Validation
spanningTree SpanningTree	SpanningTree defines the spanning tree configuration for the interface.		Optional: {}
bufferBoost BufferBoost	BufferBoost defines the buffer boost configuration for the interface. Buffer boost increases the shared buffer space allocation for the interface.		Optional: {}
lacp InterfaceConfigLACP	LACP defines LACP options for PortChannel (Aggregate) interfaces.		Optional: {}
evpnMultihoming EVPNMultihoming	EVPNMultihoming defines EVPN ESI multihoming settings for the interface.		Optional: {}
ipv6 InterfaceConfigIPv6	IPv6 defines IPv6 settings for the interface that have no equivalent in the core Interface API. Neighbor Discovery is managed on every interface that carries IPv6 configuration: settings left out here, and every setting of an interface without this field, are reset to the platform default.		Optional: {}

KeepAlive

KeepAlive defines the vPCDomain keepalive link configuration. The keep-alive is an out-of-band connection (often over mgmt0) used to monitor peer health. It does not carry data traffic.

Appears in:

• Peer

Field	Description	Default	Validation
destination string	Destination is the destination IP address of the vPC's domain peer keepalive interface. This is the IP address the local switch will send keepalive messages to.		Format: ipv4 Required: {}
source string	Source is the source IP address for keepalive messages. This is the local IP address used to send keepalive packets to the peer.		Format: ipv4 Required: {}
vrfName string	The name of the vrf used to send keepalive packets to the peer. Mutually exclusive with VrfRef.		MaxLength: 63 MinLength: 1 Optional: {}
vrfRef LocalObjectReference	The reference to a VRF resource used to send keepalive packets to the peer. Mutually exclusive with VrfName.		Optional: {}

LLDPConfig

LLDPConfig is the Schema for the LLDPConfig API

Field	Description	Default	Validation
apiVersion string	nx.cisco.networking.metal.ironcore.dev/v1alpha1
kind string	LLDPConfig
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec LLDPConfigSpec	spec defines the desired state of LLDP		Required: {}

LLDPConfigSpec

LLDPConfigSpec defines the Cisco NX-OS specific LLDP configuration.

Appears in:

• LLDPConfig

Field	Description	Default	Validation
initDelay integer	InitDelay defines the delay in seconds before LLDP starts sending packets after interface comes up.	2	Maximum: 10 Minimum: 1 Optional: {}
holdTime integer	HoldTime defines the time in seconds that the receiving device should hold the LLDP information before discarding it.	120	Maximum: 255 Minimum: 1 Optional: {}

ManagementAccessConfig

ManagementAccessConfig is the Schema for the managementaccessconfigs API

Field	Description	Default	Validation
apiVersion string	nx.cisco.networking.metal.ironcore.dev/v1alpha1
kind string	ManagementAccessConfig
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ManagementAccessConfigSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}

ManagementAccessConfigSpec

ManagementAccessConfigSpec defines the desired state of ManagementAccessConfig

Appears in:

• ManagementAccessConfig

Field	Description	Default	Validation
console Console	Console defines the configuration for the terminal console access on the device.	{ timeout:10m }	Optional: {}
ssh SSH	SSH defines the SSH server configuration for the VTY terminal access on the device.		Optional: {}

MultisiteIngReplMode

Underlying type: string

MultisiteIngReplMode defines the per-VNI multisite ingress-replication mode.

Validation:

• Enum: [Disabled Enabled EnabledOptimized]

Appears in:

• EVPNInstanceConfigSpec

Field	Description
Disabled	MultisiteIngReplDisabled disables multisite ingress replication (default).
Enabled	MultisiteIngReplEnabled enables multisite ingress replication.
EnabledOptimized	MultisiteIngReplEnabledOptimized enables optimized multisite ingress replication.

NetworkVirtualizationEdgeConfig

NetworkVirtualizationEdgeConfig is the Schema for the NetworkVirtualizationEdgeConfig API

Field	Description	Default	Validation
apiVersion string	nx.cisco.networking.metal.ironcore.dev/v1alpha1
kind string	NetworkVirtualizationEdgeConfig
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec NetworkVirtualizationEdgeConfigSpec	spec defines the desired state of NVE		Required: {}

NetworkVirtualizationEdgeConfigSpec

NetworkVirtualizationEdgeConfig defines the Cisco-specific configuration of a Network Virtualization Edge (NVE) object.

Appears in:

• NetworkVirtualizationEdgeConfig

Field	Description	Default	Validation
advertiseVirtualMAC boolean	AdvertiseVirtualMAC controls if the NVE should advertise a virtual MAC address	false	Optional: {}
holdDownTime integer	HoldDownTime defines the duration for which the switch suppresses the advertisement of the NVE loopback address.	180	Maximum: 1500 Minimum: 1 Optional: {}
infraVLANs VLANListItem array	InfraVLANs specifies VLANs used by all SVI interfaces for uplink and vPC peer-links in VXLAN as infra-VLANs. Valid VLAN IDs are 1-4092 because NX-OS always reserves VLANs 4093-4095 for internal use. The provider also checks these VLANs against the device's configurable internal reserved VLAN range. The total number of VLANs configured must not exceed 512. Elements in the list must not overlap with each other.		MaxItems: 10 Optional: {}

PIMConfig

PIMConfig is the Schema for the PIMConfig API

Field	Description	Default	Validation
apiVersion string	nx.cisco.networking.metal.ironcore.dev/v1alpha1
kind string	PIMConfig
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec PIMConfigSpec	spec defines the desired state of PIMConfig		Required: {}

PIMConfigSpec

PIMConfigSpec defines the Cisco NX-OS specific PIM configuration.

Appears in:

• PIMConfig

Field	Description	Default	Validation
logNeighborChanges boolean	LogNeighborChanges enables logging when a PIM neighbor is added or removed.		Optional: {}

Peer

Peer defines settings to configure peer settings

Appears in:

• VPCDomainSpec

Field	Description	Default	Validation
adminState AdminState	AdminState defines the administrative state of the peer-link.	Up	Enum: [Up Down] Optional: {}
interfaceRef LocalObjectReference	InterfaceRef is a reference to an Interface resource and identifies the interface to be used as the vPC domain's peer-link. This interface carries control and data traffic between the two vPC domain peers. It is usually dedicated port-channel, but it can also be a single physical interface.		Required: {}
keepalive KeepAlive	KeepAlive defines the out-of-band keepalive configuration.		Required: {}
autoRecovery AutoRecovery	AutoRecovery defines auto-recovery settings for restoring vPC domain after peer failure.		Optional: {}
switch Enabled	Switch enables peer-switch functionality on this peer. When enabled, both vPC domain peers use the same spanning-tree bridge ID, allowing both to forward traffic for all VLANs without blocking any ports.	{ enabled:false }	Optional: {}
gateway Enabled	Gateway enables peer-gateway functionality on this peer. When enabled, each vPC domain peer can act as the active gateway for packets destined to the peer's MAC address, improving convergence.	{ enabled:false }	Optional: {}
l3router Enabled	L3Router enables Layer 3 peer-router functionality on this peer.	{ enabled:false }	Optional: {}

RADIUSKeyEncryption

Underlying type: string

RADIUSKeyEncryption defines the encryption type for RADIUS server keys.

Validation:

• Enum: [Type6 Type7 Clear]

Appears in:

• AAAConfigSpec

Field	Description
Type6	RADIUSKeyEncryptionType6 uses AES encryption (more secure).
Type7	RADIUSKeyEncryptionType7 uses Cisco Type 7 encryption (reversible).
Clear	RADIUSKeyEncryptionClear sends the key in cleartext.

SSH

Appears in:

• ManagementAccessConfigSpec

Field	Description	Default	Validation
accessControlListName string	AccessControlListName defines the name of the access control list (ACL) to apply for incoming SSH connections on the VTY terminal. The ACL must be configured separately on the device.		MaxLength: 63 MinLength: 1 Optional: {}

SpanningTree

SpanningTree defines the spanning tree configuration for an interface.

Appears in:

• InterfaceConfigSpec

Field	Description	Default	Validation
portType SpanningTreePortType	PortType defines the spanning tree port type.		Enum: [Normal Edge Network Trunk] Required: {}
bpduGuard boolean	BPDUGuard enables BPDU guard on the interface. When enabled, the port is shut down if a BPDU is received.		Optional: {}
bpduFilter boolean	BPDUFilter enables BPDU filter on the interface. When enabled, BPDUs are not sent or received on the port.		Optional: {}

SpanningTreePortType

Underlying type: string

SpanningTreePortType represents the spanning tree port type.

Validation:

• Enum: [Normal Edge Network Trunk]

Appears in:

• SpanningTree

Field	Description
Normal	SpanningTreePortTypeNormal indicates a normal spanning tree port.
Edge	SpanningTreePortTypeEdge indicates an edge port (connects to end devices).
Trunk	SpanningTreePortTypeTrunk indicates a trunk port performing spanning tree calculations for multiple VLANs (connects to end devices and carries multiple VLANs).
Network	SpanningTreePortTypeNetwork indicates a network port (connects to other switches).

Status

Underlying type: string

Appears in:

• VPCDomainStatus

Field	Description
Unknown
Up
Down

StormControl

StormControl defines the storm control configuration for the border gateway, allowing to rate-limit BUM (Broadcast, Unknown unicast, Multicast) traffic on the border gateway interface.

Appears in:

• BorderGatewaySpec

Field	Description	Default	Validation
level string	Level is the suppression level as a percentage of the interface bandwidth. Must be a floating point number between 1.0 and 100.0.		Pattern: ^([1-9][0-9]?(\.[0-9]+)?|100(\.0+)?)$ Required: {}
traffic TrafficType	Traffic specifies the type of BUM traffic the storm control applies to.		Enum: [Broadcast Multicast Unicast] Required: {}

System

System is the Schema for the systems API

Field	Description	Default	Validation
apiVersion string	nx.cisco.networking.metal.ironcore.dev/v1alpha1
kind string	System
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec SystemSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status SystemStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

SystemSpec

SystemSpec defines the desired state of System

Appears in:

• System

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
jumboMtu integer	JumboMtu defines the system-wide jumbo MTU setting. Valid values are from 1501 to 9216.	9216	ExclusiveMaximum: false Maximum: 9216 Minimum: 1501 Optional: {}
reservedVlan integer	ReservedVlan specifies the VLAN ID to be reserved for system use. Valid values are from 1 to 4032.	3968	ExclusiveMaximum: false Maximum: 4032 Minimum: 1 Optional: {}
vlanLongName boolean	VlanLongName enables or disables 128-character VLAN names Disabled by default.	false	Optional: {}
relayServerIdOverrideDisable boolean	RelayServerIDOverrideDisable enables the global command "ip dhcp relay information option server-id-override-disable". Deprecated: use dhcp.relayServerIdOverrideDisable instead. This field is kept only for migration and will be removed in a future release. While both are set, the setting is enabled if either is true.	false	Optional: {}
dhcp DHCP	DHCP groups DHCP-related system settings.	{ relayServerIdOverrideDisable:false }	Optional: {}

SystemStatus

SystemStatus defines the observed state of System.

Appears in:

• System

Field	Description	Default	Validation
conditions Condition array	The conditions are a list of status objects that describe the state of the Banner.		Optional: {}

TACACSKeyEncryption

Underlying type: string

TACACSKeyEncryption defines the encryption type for TACACS+ server keys.

Validation:

• Enum: [Type6 Type7 Clear]

Appears in:

• AAAConfigSpec

Field	Description
Type6	TACACSKeyEncryptionType6 uses AES encryption (more secure).
Type7	TACACSKeyEncryptionType7 uses Cisco Type 7 encryption (reversible).
Clear	TACACSKeyEncryptionClear sends the key in cleartext.

TrafficType

Underlying type: string

TrafficType defines the type of traffic for storm control.

Validation:

• Enum: [Broadcast Multicast Unicast]

Appears in:

• StormControl

Field	Description
Broadcast	TrafficTypeBroadcast represents broadcast traffic.
Multicast	TrafficTypeMulticast represents multicast traffic.
Unicast	TrafficTypeUnicast represents unicast traffic.

VLANListItem

VLANListItem represents a single VLAN ID or a range start-end. If ID is set, rangeMin and rangeMax must be absent. If ID is absent, both rangeMin and rangeMax must be set.

Appears in:

• NetworkVirtualizationEdgeConfigSpec

Field	Description	Default	Validation
id integer			Maximum: 4092 Minimum: 1 Optional: {}
rangeMin integer			Maximum: 4092 Minimum: 1 Optional: {}
rangeMax integer			Maximum: 4092 Minimum: 1 Optional: {}

VPCDomain

VPCDomain is the Schema for the VPCDomains API

Field	Description	Default	Validation
apiVersion string	nx.cisco.networking.metal.ironcore.dev/v1alpha1
kind string	VPCDomain
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec VPCDomainSpec	spec defines the desired state of VPCDomain resource		Required: {}
status VPCDomainStatus	status defines the observed state of VPCDomain resource		Optional: {}

VPCDomainRole

Underlying type: string

The VPCDomainRole type represents the operational role of a vPC domain peer as returned by the device.

Appears in:

• VPCDomainStatus

Field	Description
Primary
Primary/Secondary
Secondary
Secondary/Primary
Unknown

VPCDomainSpec

VPCDomainSpec defines the desired state of a vPC domain (Virtual Port Channel Domain)

Appears in:

• VPCDomain

Field	Description	Default	Validation
deviceRef LocalObjectReference	DeviceName is the name of the Device this object belongs to. The Device object must exist in the same namespace. Immutable.		Required: {}
domainId integer	DomainID is the vPC domain ID (1-1000). This uniquely identifies the vPC domain and must match on both peer switches. Changing this value will recreate the vPC domain and flap the peer-link.		Maximum: 1000 Minimum: 1 Required: {}
adminState AdminState	AdminState is the administrative state of the vPC domain (enabled/disabled). When disabled, the vPC domain is administratively shut down.	Up	Enum: [Up Down] Optional: {}
rolePriority integer	RolePriority is the role priority for this vPC domain (1-65535). The switch with the lower role priority becomes the operational primary.	32667	Maximum: 65535 Minimum: 1 Optional: {}
systemPriority integer	SystemPriority is the system priority for this vPC domain (1-65535). Used to ensure that the vPC domain devices are primary devices on LACP. Must match on both peers.	32667	Maximum: 65535 Minimum: 1 Optional: {}
delayRestoreSVI integer	DelayRestoreSVI is the delay in seconds (1-3600) before bringing up interface-vlan (SVI) after peer-link comes up. This prevents traffic blackholing during convergence.	10	Maximum: 3600 Minimum: 1 Optional: {}
delayRestoreVPC integer	DelayRestoreVPC is the delay in seconds (1-3600) before bringing up the member ports after the peer-link is restored.	30	Maximum: 3600 Minimum: 1 Optional: {}
fastConvergence Enabled	FastConvergence ensures that both SVIs and member ports are shut down simultaneously when the peer-link goes down. This synchronization helps prevent traffic loss.	{ enabled:false }	Optional: {}
peer Peer	Peer contains the vPC's domain peer configuration including peer-link, keepalive.		Required: {}

VPCDomainStatus

VPCDomainStatus defines the observed state of VPCDomain.

Appears in:

• VPCDomain

Field	Description	Default	Validation
conditions Condition array	Conditions represent the latest available observations about the vPCDomain state. Standard conditions include: - Ready: overall readiness of the vPC domain - Configured: whether the vPCDomain configuration was successfully applied to the device - Operational: whether the vPC domain is operationally up. This condition is true when the status fields PeerLinkIfOperStatus, KeepAliveStatus, and PeerStatus are all set to UP. For this Cisco model there is not one single unique operational property that reflects the operational status of the vPC domain. The combination of peer status, keepalive status, and the interface used as peer-link determine the overall health and operational condition of the vPC domain.		Optional: {}
role VPCDomainRole	Role indicates the current operational role of this vPC domain peer.	Unknown	Optional: {}
keepaliveStatus Status	KeepAliveStatus indicates the status of the peer via the keepalive link.	Unknown	Optional: {}
keepaliveStatusMsg string array	KeepAliveStatusMsg provides additional information about the keepalive status, a list of strings reported by the device.		Optional: {}
peerStatus Status	PeerStatus indicates the status of the vPC domain peer-link in the latest consistency check with the peer. This means that if the adjacency is lost, e.g., due to a shutdown link, the device will not be able to perform such check and the reported status will remain unchanged (with the value of the last check).	Unknown	Optional: {}
peerStatusMsg string array	PeerStatusMsg provides additional information about the peer status, a list of strings reported by the device.		Optional: {}
peerUptime Duration	PeerUptime indicates how long the vPC domain peer has been up and reachable via keepalive.		Optional: {}
peerLinkIf string	PeerLinkIf is the name of the interface used as the vPC domain peer-link.		Optional: {}
peerLinkIfOperStatus Status	PeerLinkIfOperStatus is the Operational status of PeerLinkIf.	Unknown	Optional: {}

overlay.networking.metal.ironcore.dev/v1alpha1

Package v1alpha1 contains API Schema definitions for the overlay.networking.metal.ironcore.dev v1alpha1 API group.

Resource Types

• Network
• NetworkAttachment

Encapsulation

Encapsulation defines the encapsulation parameters for a NetworkAttachment.

Appears in:

• NetworkAttachmentSpec

Field	Description	Default	Validation
type EncapsulationType	Type is the encapsulation method.		Enum: [VLAN] Required: {}
id integer	Id is the identifier for the encapsulation method. For VLAN, this is the VLAN ID.		Maximum: 4094 Minimum: 1 Required: {}

EncapsulationType

Underlying type: string

EncapsulationType is the encapsulation method used for a NetworkAttachment.

Validation:

• Enum: [VLAN]

Appears in:

• Encapsulation

Field	Description
VLAN	EncapsulationTypeVLAN uses IEEE 802.1Q VLAN tagging.

Network

Network is the Schema for the networks API

Field	Description	Default	Validation
apiVersion string	overlay.networking.metal.ironcore.dev/v1alpha1
kind string	Network
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec NetworkSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status NetworkStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

NetworkAttachment

NetworkAttachment is the Schema for the networkattachments API

Field	Description	Default	Validation
apiVersion string	overlay.networking.metal.ironcore.dev/v1alpha1
kind string	NetworkAttachment
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec NetworkAttachmentSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status NetworkAttachmentStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

NetworkAttachmentSpec

NetworkAttachmentSpec defines the desired state of NetworkAttachment

Appears in:

• NetworkAttachment

Field	Description	Default	Validation
networkRef LocalObjectReference	NetworkRef references the [Network] this attachment is associated with. Immutable.		Required: {}
interfaceSelector LabelSelector	InterfaceSelector selects Interface resources to attach to the network. Type filtering (Physical ∪ Aggregate) is enforced by the controller at reconcile time, not by the selector itself.		Required: {}
encapsulation Encapsulation	Encapsulation defines the encapsulation parameters for this attachment.		Required: {}

NetworkAttachmentStatus

NetworkAttachmentStatus defines the observed state of NetworkAttachment.

Appears in:

• NetworkAttachment

Field	Description	Default	Validation
conditions Condition array	conditions represent the current state of the NetworkAttachment resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. The status of each condition is one of True, False, or Unknown.		Optional: {}

NetworkSpec

NetworkSpec defines the desired state of Network

Appears in:

• Network

NetworkStatus

NetworkStatus defines the observed state of Network.

Appears in:

• Network

Field	Description	Default	Validation
conditions Condition array	conditions represent the current state of the Network resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. The status of each condition is one of True, False, or Unknown.		Optional: {}

pool.networking.metal.ironcore.dev/v1alpha1

Package v1alpha1 contains API Schema definitions for the pool.networking.metal.ironcore.dev v1alpha1 API group.

Resource Types

• Claim
• IPAddress
• IPAddressPool
• IPPrefix
• IPPrefixPool
• Index
• IndexPool

Claim

Claim is the Schema for the claims API

Field	Description	Default	Validation
apiVersion string	pool.networking.metal.ironcore.dev/v1alpha1
kind string	Claim
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ClaimSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status ClaimStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

ClaimRef

ClaimRef identifies the Claim bound to an allocation object.

Appears in:

• IPAddressSpec
• IPPrefixSpec
• IndexSpec

Field	Description	Default	Validation
name string	Name is the name of the Claim.		Required: {}
uid UID	UID is the UID of the Claim. When both name and UID match, the allocation is considered fully bound. When the name matches but the UID is stale or empty (e.g. after the original Claim was deleted and recreated), the claim controller will only rebind if the allocation carries the 'pool.networking.metal.ironcore.dev/allow-binding' annotation.		Required: {}

ClaimSpec

ClaimSpec defines the desired state of Claim.

Appears in:

• Claim

Field	Description	Default	Validation
poolRef TypedLocalObjectReference	PoolRef references the allocation pool to allocate from. PoolRef is immutable once set.		Required: {}

ClaimStatus

ClaimStatus defines the observed state of Claim.

Appears in:

• Claim

Field	Description	Default	Validation
conditions Condition array	conditions represent the current state of the Claim resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. The status of each condition is one of True, False, or Unknown.		Optional: {}
allocationRef TypedLocalObjectReference	AllocationRef references the bound allocation object (Index, IPAddress, or IPPrefix). Set by the claim controller after successful binding.		Optional: {}
value string	Value is the allocated resource as a string, mirrored from the bound allocation for convenient access without chasing the reference.		Optional: {}

IPAddress

IPAddress is the Schema for the ipaddresses API.

Field	Description	Default	Validation
apiVersion string	pool.networking.metal.ironcore.dev/v1alpha1
kind string	IPAddress
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec IPAddressSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status IPAddressStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

IPAddressPool

IPAddressPool is the Schema for the ipaddresspools API

Field	Description	Default	Validation
apiVersion string	pool.networking.metal.ironcore.dev/v1alpha1
kind string	IPAddressPool
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec IPAddressPoolSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status IPAddressPoolStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

IPAddressPoolSpec

IPAddressPoolSpec defines the desired state of IPAddressPool

Appears in:

• IPAddressPool

Field	Description	Default	Validation
prefixes IPPrefix array	Prefixes defines the CIDR ranges that can be allocated.		Format: cidr MinItems: 1 Type: string Required: {}
reclaimPolicy ReclaimPolicy	ReclaimPolicy controls what happens to an allocation when a claim is deleted. Recycle returns the allocation to the pool. Retain keeps it reserved. Immutable.	Recycle	Enum: [Recycle Retain] Optional: {}

IPAddressPoolStatus

IPAddressPoolStatus defines the observed state of IPAddressPool.

Appears in:

• IPAddressPool

Field	Description	Default	Validation
allocated integer	Allocated is the number of allocated IP addresses.		Optional: {}
total string	Total is the number of allocatable IP addresses.		Optional: {}
conditions Condition array	conditions represent the current state of the IPAddressPool resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. The status of each condition is one of True, False, or Unknown.		Optional: {}

IPAddressSpec

IPAddressSpec defines the desired state of IPAddress.

Appears in:

• IPAddress

Field	Description	Default	Validation
poolRef TypedLocalObjectReference	PoolRef references the IPAddressPool this address was allocated from. Immutable.		Required: {}
address IPAddr	Address is the reserved IP address. Immutable.		Format: ip Type: string Required: {}
claimRef ClaimRef	ClaimRef references the Claim bound to this address. Nil when the address is unbound (pre-provisioned or retained).		Optional: {}

IPAddressStatus

IPAddressStatus defines the observed state of IPAddress.

Appears in:

• IPAddress

Field	Description	Default	Validation
conditions Condition array	conditions represent the current state of the IPAddress resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. The status of each condition is one of True, False, or Unknown.		Optional: {}

IPPrefix

IPPrefix is the Schema for the ipprefixes API.

Field	Description	Default	Validation
apiVersion string	pool.networking.metal.ironcore.dev/v1alpha1
kind string	IPPrefix
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec IPPrefixSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status IPPrefixStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

IPPrefixPool

IPPrefixPool is the Schema for the ipprefixpools API

Field	Description	Default	Validation
apiVersion string	pool.networking.metal.ironcore.dev/v1alpha1
kind string	IPPrefixPool
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec IPPrefixPoolSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status IPPrefixPoolStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

IPPrefixPoolSpec

IPPrefixPoolSpec defines the desired state of IPPrefixPool

Appears in:

• IPPrefixPool

Field	Description	Default	Validation
prefixes IPPrefix array	Prefixes defines the base prefixes to allocate from.		Format: cidr MinItems: 1 Type: string Required: {}
allocationPrefixLength integer	AllocationPrefixLength is the prefix length to allocate within each base prefix.		Maximum: 128 Minimum: 0 Required: {}
reclaimPolicy ReclaimPolicy	ReclaimPolicy controls what happens to an allocation when a claim is deleted. Recycle returns the allocation to the pool. Retain keeps it reserved. Immutable.	Recycle	Enum: [Recycle Retain] Optional: {}

IPPrefixPoolStatus

IPPrefixPoolStatus defines the observed state of IPPrefixPool.

Appears in:

• IPPrefixPool

Field	Description	Default	Validation
allocated integer	Allocated is the number of allocated prefixes.		Optional: {}
total string	Total is the number of allocatable prefixes.		Optional: {}
conditions Condition array	conditions represent the current state of the IPPrefixPool resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. The status of each condition is one of True, False, or Unknown.		Optional: {}

IPPrefixSpec

IPPrefixSpec defines the desired state of IPPrefix.

Appears in:

• IPPrefix

Field	Description	Default	Validation
poolRef TypedLocalObjectReference	PoolRef references the IPPrefixPool this prefix was allocated from. Immutable.		Required: {}
prefix IPPrefix	Prefix is the reserved CIDR prefix. Immutable.		Format: cidr Type: string Required: {}
claimRef ClaimRef	ClaimRef references the Claim bound to this prefix. Nil when the prefix is unbound (pre-provisioned or retained).		Optional: {}

IPPrefixStatus

IPPrefixStatus defines the observed state of IPPrefix.

Appears in:

• IPPrefix

Field	Description	Default	Validation
conditions Condition array	conditions represent the current state of the IPPrefix resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. The status of each condition is one of True, False, or Unknown.		Optional: {}

Index

Index is the Schema for the indices API.

Field	Description	Default	Validation
apiVersion string	pool.networking.metal.ironcore.dev/v1alpha1
kind string	Index
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec IndexSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status IndexStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

IndexPool

IndexPool is the Schema for the indexpools API

Field	Description	Default	Validation
apiVersion string	pool.networking.metal.ironcore.dev/v1alpha1
kind string	IndexPool
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec IndexPoolSpec	Specification of the desired state of the resource. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Required: {}
status IndexPoolStatus	Status of the resource. This is set and updated automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		Optional: {}

IndexPoolSpec

IndexPoolSpec defines the desired state of IndexPool

Appears in:

• IndexPool

Field	Description	Default	Validation
ranges IndexRange array	Ranges defines the inclusive index ranges that can be allocated. Example: "64512..65534".		MinItems: 1 Pattern: ^[0-9]+(\.\.[0-9]+)?$ Type: string XIntOrString: {} Required: {}
reclaimPolicy ReclaimPolicy	ReclaimPolicy controls what happens to an allocation when a claim is deleted. Recycle returns the allocation to the pool. Retain keeps it reserved. Immutable.	Recycle	Enum: [Recycle Retain] Optional: {}

IndexPoolStatus

IndexPoolStatus defines the observed state of IndexPool.

Appears in:

• IndexPool

Field	Description	Default	Validation
allocated integer	Allocated is the number of allocated indices.		Optional: {}
total string	Total is the number of allocatable indices.		Optional: {}
conditions Condition array	conditions represent the current state of the IndexPool resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. The status of each condition is one of True, False, or Unknown.		Optional: {}

IndexSpec

IndexSpec defines the desired state of Index.

Appears in:

• Index

Field	Description	Default	Validation
poolRef TypedLocalObjectReference	PoolRef references the IndexPool this index was allocated from. Immutable.		Required: {}
index integer	Index is the reserved value. Immutable.		Minimum: 0 Required: {}
claimRef ClaimRef	ClaimRef references the Claim bound to this index. Nil when the index is unbound (pre-provisioned or retained).		Optional: {}

IndexStatus

IndexStatus defines the observed state of Index.

Appears in:

• Index

Field	Description	Default	Validation
conditions Condition array	conditions represent the current state of the Index resource. Each condition has a unique type and reflects the status of a specific aspect of the resource. The status of each condition is one of True, False, or Unknown.		Optional: {}

ReclaimPolicy

Underlying type: string

ReclaimPolicy defines how allocations are handled on claim deletion.

Validation:

• Enum: [Recycle Retain]

Appears in:

• IPAddressPoolSpec
• IPPrefixPoolSpec
• IndexPoolSpec

Field	Description
Recycle
Retain

xe.cisco.networking.metal.ironcore.dev/v1alpha1

Package v1alpha1 contains API Schema definitions for the xe.cisco.networking.metal.ironcore.dev v1alpha1 API group.

xr.cisco.networking.metal.ironcore.dev/v1alpha1

Package v1alpha1 contains API Schema definitions for the xr.cisco.networking.metal.ironcore.dev v1alpha1 API group.