{
   "expose": [
      {
         "args": [
            {
               "example": "storefront.example.com",
               "name": "host",
               "required": true,
               "type": "hostname"
            },
            {
               "example": "shared",
               "name": "gateway",
               "required": true,
               "type": "string"
            },
            {
               "name": "gatewayNamespace",
               "required": false,
               "type": "string"
            },
            {
               "name": "sectionName",
               "required": false,
               "type": "string"
            }
         ],
         "exclusiveGroup": "exposure",
         "help": "Attaches an HTTPRoute to an existing shared Gateway (the usual platform-team setup).",
         "id": "gateway",
         "kinds": [
            "http"
         ],
         "requiresService": true
      },
      {
         "args": [
            {
               "example": "storefront.example.com",
               "name": "host",
               "required": true,
               "type": "hostname"
            },
            {
               "name": "ingressClass",
               "required": false,
               "type": "string"
            }
         ],
         "exclusiveGroup": "exposure",
         "help": "Routes the host to the workload through the Ingress API.",
         "id": "ingress",
         "kinds": [
            "http"
         ],
         "requiresService": true
      },
      {
         "args": [
            {
               "example": "storefront.example.com",
               "name": "host",
               "required": true,
               "type": "hostname"
            },
            {
               "example": "tenant-a",
               "name": "listenerSet",
               "required": true,
               "type": "string"
            },
            {
               "name": "listenerSetNamespace",
               "required": false,
               "type": "string"
            },
            {
               "name": "sectionName",
               "required": false,
               "type": "string"
            }
         ],
         "exclusiveGroup": "exposure",
         "help": "Attaches an HTTPRoute to an existing ListenerSet (per-tenant listener ownership).",
         "id": "listenerSet",
         "kinds": [
            "http"
         ],
         "requiresService": true
      },
      {
         "args": [
            {
               "example": "storefront.example.com",
               "name": "host",
               "required": true,
               "type": "hostname"
            },
            {
               "example": "istio",
               "name": "gatewayClass",
               "required": true,
               "type": "string"
            }
         ],
         "exclusiveGroup": "exposure",
         "help": "Generates a dedicated Gateway plus the HTTPRoute — for clusters with no shared Gateway to attach to.",
         "id": "ownGateway",
         "kinds": [
            "http"
         ],
         "requiresService": true
      },
      {
         "args": [
            {
               "example": "storefront.example.com",
               "name": "host",
               "required": true,
               "type": "hostname"
            },
            {
               "example": "shared",
               "name": "gateway",
               "required": true,
               "type": "string"
            },
            {
               "name": "gatewayNamespace",
               "required": false,
               "type": "string"
            }
         ],
         "exclusiveGroup": "exposure",
         "help": "Generates a ListenerSet that adds the workload's own listener to a shared Gateway, plus the HTTPRoute. The Gateway must opt in via spec.allowedListeners.",
         "id": "ownListenerSet",
         "kinds": [
            "http"
         ],
         "requiresService": true
      }
   ],
   "features": [
      {
         "args": [
            {
               "example": {
                  "nodeAffinity": {
                     "requiredDuringSchedulingIgnoredDuringExecution": {
                        "nodeSelectorTerms": [
                           {
                              "matchExpressions": [
                                 {
                                    "key": "disktype",
                                    "operator": "In",
                                    "values": [
                                       "ssd"
                                    ]
                                 }
                              ]
                           }
                        ]
                     }
                  }
               },
               "name": "affinity",
               "required": true,
               "type": "object"
            }
         ],
         "group": "placement",
         "help": "A pod/node affinity object, merged onto the pod template.",
         "id": "affinity",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": {
                  "prometheus.io/scrape": "true"
               },
               "name": "annotations",
               "required": true,
               "type": "object"
            }
         ],
         "group": "container",
         "help": "Extra annotations on metadata and the pod template.",
         "id": "annotations",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": [
                  {
                     "apiGroups": [
                        ""
                     ],
                     "resources": [
                        "pods"
                     ],
                     "verbs": [
                        "patch"
                     ]
                  }
               ],
               "name": "rules",
               "required": true,
               "type": "array"
            },
            {
               "default": [
                  443,
                  6443
               ],
               "name": "ports",
               "required": false,
               "type": "array"
            }
         ],
         "group": "security",
         "help": "Declares a pod as a Kubernetes API client: adds the given Role rules AND best-effort NetworkPolicy egress to the apiserver, both as cross-cutting requirements that compose with (never clobber) a consumer own rbac()/networkPolicy().",
         "id": "apiServerClient",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": [
                  "backend",
                  "--config=/etc/tik/pipelines.edn"
               ],
               "name": "args",
               "required": true,
               "type": "array"
            }
         ],
         "group": "container",
         "help": "Appends arguments to the image's own entrypoint — typically a subcommand selecting the workload.",
         "id": "args",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": [
                  "/bin/app"
               ],
               "name": "command",
               "required": true,
               "type": "array"
            }
         ],
         "group": "container",
         "help": "Overrides the image entrypoint entirely.",
         "id": "command",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": "Forbid",
               "name": "concurrencyPolicy",
               "required": true,
               "type": "string"
            }
         ],
         "group": "scheduling",
         "help": "How to treat a job that is still running when the next is due (Allow/Forbid/Replace).",
         "id": "concurrencyPolicy",
         "kinds": [
            "cron"
         ]
      },
      {
         "args": [
            {
               "example": {
                  "app.conf": "key = value"
               },
               "name": "files",
               "required": true,
               "type": "object"
            },
            {
               "default": "/etc/config",
               "name": "mountPath",
               "required": false,
               "type": "path"
            }
         ],
         "group": "storage",
         "help": "Renders a ConfigMap from a filename→content map and mounts it read-only.",
         "id": "config",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": {
                  "LOG_LEVEL": "info"
               },
               "name": "env",
               "required": true,
               "type": "object"
            }
         ],
         "group": "container",
         "help": "Environment variables as a name→value map, appended to the container.",
         "id": "env",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": 6379,
               "name": "port",
               "required": false,
               "type": "int"
            },
            {
               "default": false,
               "name": "publishNotReady",
               "required": false,
               "type": "bool"
            }
         ],
         "group": "networking",
         "help": "A headless Service (clusterIP: None) selecting the pods, for DNS peer discovery — the discovery a replication hand-off needs.",
         "id": "headlessService",
         "kinds": [
            "http",
            "worker",
            "daemon",
            "stateful"
         ]
      },
      {
         "args": [ ],
         "group": "security",
         "help": "Shares the host user namespace (relaxes hostUsers=false).",
         "id": "hostUsers",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": 2,
               "name": "minReplicas",
               "required": true,
               "type": "int"
            },
            {
               "example": 10,
               "name": "maxReplicas",
               "required": true,
               "type": "int"
            },
            {
               "example": 80,
               "name": "targetCPU",
               "required": false,
               "type": "int"
            },
            {
               "name": "targetMemory",
               "required": false,
               "type": "int"
            }
         ],
         "group": "reliability",
         "help": "A HorizontalPodAutoscaler scaling the Deployment on CPU and/or memory utilization.",
         "id": "hpa",
         "kinds": [
            "http",
            "worker"
         ]
      },
      {
         "args": [
            {
               "example": "ghcr.io/acme/app:1.2.3",
               "name": "image",
               "required": true,
               "type": "string"
            }
         ],
         "group": "container",
         "help": "Overrides the container image.",
         "id": "image",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": [
                  "regcred"
               ],
               "name": "names",
               "required": true,
               "type": "array"
            }
         ],
         "group": "container",
         "help": "Names of existing Secrets the kubelet uses to pull the image.",
         "id": "imagePullSecrets",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": {
                  "command": [
                     "sh",
                     "-c",
                     "echo ready"
                  ],
                  "image": "busybox:1",
                  "name": "setup"
               },
               "name": "container",
               "required": true,
               "type": "object"
            }
         ],
         "group": "container",
         "help": "An init container run to completion before the main one — the full container spec, passed through. Composes more than once.",
         "id": "initContainer",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": {
                  "team": "payments"
               },
               "name": "labels",
               "required": true,
               "type": "object"
            }
         ],
         "group": "container",
         "help": "Extra labels on metadata and the pod template (never on immutable selectors).",
         "id": "labels",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": {
                  "exec": {
                     "command": [
                        "sh",
                        "-c",
                        "valkey-cli failover"
                     ]
                  }
               },
               "name": "preStop",
               "required": false,
               "type": "object"
            },
            {
               "name": "postStart",
               "required": false,
               "type": "object"
            }
         ],
         "group": "container",
         "help": "Container lifecycle handlers (postStart / preStop), passed through verbatim.",
         "id": "lifecycle",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": {
                  "tcpSocket": {
                     "port": 6379
                  }
               },
               "name": "probe",
               "required": true,
               "type": "object"
            }
         ],
         "group": "container",
         "help": "An explicit liveness probe spec (exec/tcpSocket/httpGet), overriding the default http probe.",
         "id": "livenessProbe",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "name": "ingress",
               "required": false,
               "type": "array"
            },
            {
               "name": "egress",
               "required": false,
               "type": "array"
            },
            {
               "name": "policyTypes",
               "required": false,
               "type": "array"
            }
         ],
         "group": "networking",
         "help": "A NetworkPolicy firewalling the pods (ingress/egress rules and policyTypes passed through verbatim).",
         "id": "networkPolicy",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": {
                  "disktype": "ssd"
               },
               "name": "nodeSelector",
               "required": true,
               "type": "object"
            }
         ],
         "group": "placement",
         "help": "Restricts the pod to nodes carrying these labels.",
         "id": "nodeSelector",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": 1,
               "name": "minAvailable",
               "required": false,
               "type": "any"
            },
            {
               "name": "maxUnavailable",
               "required": false,
               "type": "any"
            }
         ],
         "group": "reliability",
         "help": "A PodDisruptionBudget capping voluntary disruption. Set one of minAvailable / maxUnavailable.",
         "id": "pdb",
         "kinds": [
            "http",
            "worker",
            "daemon",
            "stateful"
         ]
      },
      {
         "args": [
            {
               "example": {
                  "linkerd.io/inject": "enabled"
               },
               "name": "podAnnotations",
               "required": true,
               "type": "object"
            }
         ],
         "group": "container",
         "help": "Annotations on the pod template ONLY — for sidecar injection and scrape hints that are meaningless on the controller object.",
         "id": "podAnnotations",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": {
                  "tier": "database"
               },
               "name": "podLabels",
               "required": true,
               "type": "object"
            }
         ],
         "group": "container",
         "help": "Labels on the pod template ONLY (never the workload metadata or the immutable selector) — for network-policy selectors and log collection.",
         "id": "podLabels",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": 8080,
               "name": "port",
               "required": true,
               "type": "int"
            }
         ],
         "group": "container",
         "help": "The container port the workload listens on (also the Service target).",
         "id": "port",
         "kinds": [
            "http"
         ]
      },
      {
         "args": [
            {
               "example": "high-priority",
               "name": "priorityClassName",
               "required": true,
               "type": "string"
            }
         ],
         "group": "container",
         "help": "The pod's scheduling priority class.",
         "id": "priorityClassName",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "default": "/healthz",
               "example": "/tickets.edn",
               "name": "path",
               "required": false,
               "type": "path"
            }
         ],
         "group": "container",
         "help": "HTTP readiness and liveness probes on the named http port.",
         "id": "probes",
         "kinds": [
            "http"
         ]
      },
      {
         "args": [
            {
               "example": [
                  {
                     "apiGroups": [
                        ""
                     ],
                     "resources": [
                        "configmaps"
                     ],
                     "verbs": [
                        "get",
                        "list",
                        "watch"
                     ]
                  }
               ],
               "name": "rules",
               "required": true,
               "type": "array"
            }
         ],
         "group": "security",
         "help": "Mints a ServiceAccount, a namespaced Role with the given rules, and the RoleBinding, and runs the pod under that ServiceAccount.",
         "id": "rbac",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": {
                  "exec": {
                     "command": [
                        "sh",
                        "-c",
                        "valkey-cli ping"
                     ]
                  }
               },
               "name": "probe",
               "required": true,
               "type": "object"
            }
         ],
         "group": "container",
         "help": "An explicit readiness probe spec (exec/tcpSocket/httpGet), overriding the default http probe.",
         "id": "readinessProbe",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [ ],
         "group": "container",
         "help": "The single-writer strategy: tears the old pod down before starting the new one, so a ReadWriteOnce store never deadlocks a rollout.",
         "id": "recreate",
         "kinds": [
            "http",
            "worker"
         ]
      },
      {
         "args": [
            {
               "example": 3,
               "name": "replicas",
               "required": true,
               "type": "int"
            }
         ],
         "group": "container",
         "help": "The desired number of pod replicas.",
         "id": "replicas",
         "kinds": [
            "http",
            "worker",
            "stateful"
         ]
      },
      {
         "args": [
            {
               "example": "small",
               "name": "preset",
               "required": true,
               "type": "string"
            }
         ],
         "group": "container",
         "help": "A named resource size (nano/micro/small/medium/large) — a memory request equal to its limit and a CPU request with no limit. Replaces resources wholesale.",
         "id": "resourcePreset",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": {
                  "cpu": "100m",
                  "memory": "128Mi"
               },
               "name": "requests",
               "required": false,
               "type": "object"
            },
            {
               "example": {
                  "memory": "256Mi"
               },
               "name": "limits",
               "required": false,
               "type": "object"
            }
         ],
         "group": "container",
         "help": "Container resource requests and/or limits.",
         "id": "resources",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": 1,
               "name": "maxSurge",
               "required": false,
               "type": "any"
            },
            {
               "name": "maxUnavailable",
               "required": false,
               "type": "any"
            }
         ],
         "group": "container",
         "help": "RollingUpdate tuning so a new pod surges alongside the old during an update — the overlap a replication hand-off needs.",
         "id": "rollingUpdate",
         "kinds": [
            "http",
            "worker"
         ]
      },
      {
         "args": [ ],
         "group": "security",
         "help": "Allows the container to run as root (relaxes runAsNonRoot).",
         "id": "rootUser",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": 12345,
               "name": "uid",
               "required": true,
               "type": "int"
            },
            {
               "name": "gid",
               "required": false,
               "type": "int"
            },
            {
               "name": "fsGroup",
               "required": false,
               "type": "int"
            }
         ],
         "group": "security",
         "help": "Pins the run-as user/group (and matching fsGroup) for images that do not declare a non-root USER.",
         "id": "runAs",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": "0 2 * * *",
               "name": "schedule",
               "required": true,
               "type": "string"
            }
         ],
         "group": "scheduling",
         "help": "The cron schedule expression.",
         "id": "schedule",
         "kinds": [
            "cron"
         ]
      },
      {
         "args": [
            {
               "example": "/tmp",
               "name": "mountPath",
               "required": true,
               "type": "path"
            },
            {
               "name": "sizeLimit",
               "required": false,
               "type": "quantity"
            }
         ],
         "group": "storage",
         "help": "A writable emptyDir — the escape valve a read-only root filesystem needs for /tmp and the like.",
         "id": "scratch",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": "tik-tls",
               "name": "secretName",
               "required": true,
               "type": "string"
            },
            {
               "example": "/etc/tls",
               "name": "mountPath",
               "required": true,
               "type": "path"
            },
            {
               "default": true,
               "name": "readOnly",
               "required": false,
               "type": "bool"
            },
            {
               "default": false,
               "name": "optional",
               "required": false,
               "type": "bool"
            },
            {
               "name": "defaultMode",
               "required": false,
               "type": "int"
            }
         ],
         "group": "storage",
         "help": "Mounts an EXISTING Secret (kurly never mints key material).",
         "id": "secretMount",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": "storefront",
               "name": "serviceAccountName",
               "required": true,
               "type": "string"
            }
         ],
         "group": "container",
         "help": "Runs the pod under a named ServiceAccount (also gates token automount).",
         "id": "serviceAccount",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "default": "http",
               "name": "port",
               "required": false,
               "type": "string"
            },
            {
               "default": "/metrics",
               "name": "path",
               "required": false,
               "type": "path"
            },
            {
               "name": "interval",
               "required": false,
               "type": "string"
            }
         ],
         "group": "observability",
         "help": "A Prometheus-Operator ServiceMonitor scraping the workload Service.",
         "id": "serviceMonitor",
         "kinds": [
            "http"
         ]
      },
      {
         "args": [
            {
               "example": "/var/lib/tik",
               "name": "mountPath",
               "required": true,
               "type": "path"
            },
            {
               "example": "1Gi",
               "name": "size",
               "required": true,
               "type": "quantity"
            },
            {
               "default": [
                  "ReadWriteOnce"
               ],
               "name": "accessModes",
               "required": false,
               "type": "array"
            },
            {
               "name": "storageClass",
               "required": false,
               "type": "string"
            },
            {
               "name": "selector",
               "required": false,
               "type": "object"
            },
            {
               "name": "annotations",
               "required": false,
               "type": "object"
            }
         ],
         "group": "storage",
         "help": "The workload's own PersistentVolumeClaim, mounted at a path.",
         "id": "store",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": "RollingUpdate",
               "name": "strategy",
               "required": true,
               "type": "string"
            }
         ],
         "group": "container",
         "help": "The Deployment update strategy.",
         "id": "strategy",
         "kinds": [
            "http",
            "worker"
         ]
      },
      {
         "args": [
            {
               "example": 120,
               "name": "seconds",
               "required": true,
               "type": "int"
            }
         ],
         "group": "container",
         "help": "How long the pod gets to shut down gracefully (a preStop hook's window).",
         "id": "terminationGracePeriod",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": [
                  {
                     "effect": "NoSchedule",
                     "key": "gpu",
                     "operator": "Exists"
                  }
               ],
               "name": "tolerations",
               "required": true,
               "type": "array"
            }
         ],
         "group": "placement",
         "help": "Tolerations letting the pod schedule onto tainted nodes.",
         "id": "tolerations",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": [
                  {
                     "labelSelector": {
                        "matchLabels": {
                           "app.kubernetes.io/name": "web"
                        }
                     },
                     "maxSkew": 1,
                     "topologyKey": "kubernetes.io/hostname",
                     "whenUnsatisfiable": "DoNotSchedule"
                  }
               ],
               "name": "constraints",
               "required": true,
               "type": "array"
            }
         ],
         "group": "placement",
         "help": "Topology-spread constraints spreading the pods across a topology domain (keep version-bound labels in the selector so a rollout spreads the new set independently).",
         "id": "topologySpread",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [
            {
               "example": "1.2.3",
               "name": "version",
               "required": true,
               "type": "string"
            }
         ],
         "group": "container",
         "help": "The workload version, stamped as app.kubernetes.io/version on every object.",
         "id": "version",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      },
      {
         "args": [ ],
         "group": "security",
         "help": "Makes the root filesystem writable (relaxes readOnlyRootFilesystem).",
         "id": "writableRootFilesystem",
         "kinds": [
            "http",
            "worker",
            "cron",
            "daemon",
            "stateful",
            "job"
         ]
      }
   ],
   "helpers": [
      {
         "args": [
            {
               "name": "parts",
               "required": true,
               "type": "array"
            }
         ],
         "help": "Builds one flat array from parts that may be null (dropped) or nested arrays (flattened one level), for assembling any value with conditionals and optional groups. A Jsonnet `if` with no else is null when false, so an unmet condition drops out.",
         "id": "join"
      },
      {
         "args": [
            {
               "name": "app",
               "required": true,
               "type": "object"
            }
         ],
         "help": "Renders one composed app as a kind: List, including its hidden owned manifests (the store PVC, the config ConfigMap).",
         "id": "list"
      },
      {
         "args": [
            {
               "name": "parts",
               "required": true,
               "type": "array"
            }
         ],
         "help": "Renders an explicit set of parts as a kind: List. Joins the parts first, so entries can be null (dropped) or nested arrays (flattened) — build the set with conditionals and optional groups.",
         "id": "listOf"
      }
   ],
   "kinds": [
      {
         "args": [
            {
               "example": "nightly-report",
               "name": "name",
               "required": true,
               "type": "string"
            },
            {
               "example": "ghcr.io/acme/report:1.2.3",
               "name": "image",
               "required": true,
               "type": "string"
            },
            {
               "example": "0 2 * * *",
               "name": "schedule",
               "required": true,
               "type": "string"
            }
         ],
         "hasService": false,
         "help": "A scheduled job: a CronJob that runs to completion on a cron schedule.",
         "id": "cron"
      },
      {
         "args": [
            {
               "example": "node-exporter",
               "name": "name",
               "required": true,
               "type": "string"
            },
            {
               "example": "ghcr.io/acme/node-agent:1.2.3",
               "name": "image",
               "required": true,
               "type": "string"
            }
         ],
         "hasService": false,
         "help": "A per-node agent: a DaemonSet running one pod on every node.",
         "id": "daemon"
      },
      {
         "args": [
            {
               "example": "storefront",
               "name": "name",
               "required": true,
               "type": "string"
            },
            {
               "example": "ghcr.io/acme/storefront:1.2.3",
               "name": "image",
               "required": true,
               "type": "string"
            }
         ],
         "hasService": true,
         "help": "An HTTP workload: a Deployment (2 replicas) and a ClusterIP Service. Compose an exposure feature to accept traffic from outside the cluster.",
         "id": "http"
      },
      {
         "args": [
            {
               "example": "db-migrate",
               "name": "name",
               "required": true,
               "type": "string"
            },
            {
               "example": "ghcr.io/acme/migrate:1.2.3",
               "name": "image",
               "required": true,
               "type": "string"
            }
         ],
         "hasService": false,
         "help": "A one-off task that runs to completion: a Job with restartPolicy OnFailure. No Service, no replicas.",
         "id": "job"
      },
      {
         "args": [
            {
               "example": "postgres",
               "name": "name",
               "required": true,
               "type": "string"
            },
            {
               "example": "ghcr.io/acme/postgres:16",
               "name": "image",
               "required": true,
               "type": "string"
            }
         ],
         "hasService": true,
         "help": "A workload with stable identity and per-pod storage: a StatefulSet plus the headless Service that names it. The store feature renders as a per-pod volumeClaimTemplate.",
         "id": "stateful"
      },
      {
         "args": [
            {
               "example": "indexer",
               "name": "name",
               "required": true,
               "type": "string"
            },
            {
               "example": "ghcr.io/acme/indexer:1.2.3",
               "name": "image",
               "required": true,
               "type": "string"
            }
         ],
         "hasService": false,
         "help": "A background worker: a Deployment with no Service. Reaches out (queues, schedules) rather than serving traffic.",
         "id": "worker"
      }
   ],
   "migrations": [
      {
         "args": [
            {
               "example": "2026.5.25",
               "name": "name",
               "required": true,
               "type": "string"
            },
            {
               "example": "2026.5.25",
               "name": "to",
               "required": true,
               "type": "string"
            },
            {
               "name": "from",
               "required": false,
               "type": "string"
            },
            {
               "name": "stage",
               "required": false,
               "type": "string"
            },
            {
               "name": "actions",
               "required": false,
               "type": "array"
            }
         ],
         "help": "Builds one entry of a stageset-controller migration ladder (a plain array of these). Actions are passed through verbatim.",
         "id": "migration"
      }
   ],
   "schemaVersion": 1,
   "security": [
      {
         "args": [ ],
         "help": "Relaxes what only restricted requires (root allowed, default capabilities kept, privilege escalation and unpinned seccomp permitted); keeps the read-only root filesystem and user namespaces.",
         "id": "baseline"
      },
      {
         "args": [ ],
         "help": "Emits no security fields at all — the manifest constrains nothing.",
         "id": "privileged"
      },
      {
         "args": [ ],
         "help": "The default posture, written out. Compose after another profile to re-tighten.",
         "id": "restricted"
      }
   ],
   "workloads": [
      {
         "id": "cnpg-cluster",
         "stages": [
            {
               "args": [
                  {
                     "default": "postgres",
                     "name": "name",
                     "required": false,
                     "type": "string"
                  },
                  {
                     "default": 3,
                     "name": "instances",
                     "required": false,
                     "type": "int"
                  },
                  {
                     "default": "10Gi",
                     "name": "storageSize",
                     "required": false,
                     "type": "quantity"
                  },
                  {
                     "default": "app",
                     "name": "database",
                     "required": false,
                     "type": "string"
                  }
               ],
               "help": "The PostgreSQL Cluster CR. Adapt it with the parameters and render with kurly.list — composed by parameter, not by + feature (it is a custom resource, not a base kind).",
               "id": "cluster",
               "importPath": "github.com/metio/kurly/workloads/cnpg-cluster/cluster.libsonnet",
               "kind": "cnpg"
            }
         ],
         "summary": "A highly-available PostgreSQL cluster as a CloudNativePG Cluster custom resource (three instances, a bootstrapped database, a PodMonitor). Requires the CloudNativePG operator."
      },
      {
         "id": "tik",
         "stages": [
            {
               "args": [
                  {
                     "default": "ghcr.io/metio/tik:2026.7.14194001",
                     "name": "image",
                     "required": false,
                     "type": "string"
                  }
               ],
               "help": "The tik backend supervisor: a single-writer http app over a ReadWriteOnce store (one replica, recreated to avoid deadlocking on the volume). Compose an exposure recipe to serve the board.",
               "id": "backend",
               "importPath": "github.com/metio/kurly/workloads/tik/backend.libsonnet",
               "kind": "http"
            }
         ],
         "summary": "A lightweight ticket board and release supervisor. One process serves a read-only board and runs the store's writers over a shared append-only event store."
      },
      {
         "id": "valkey",
         "stages": [
            {
               "args": [
                  {
                     "default": "docker.io/valkey/valkey:9.0.3",
                     "name": "image",
                     "required": false,
                     "type": "string"
                  },
                  {
                     "default": "256mb",
                     "name": "maxMemory",
                     "required": false,
                     "type": "string"
                  }
               ],
               "help": "An in-memory Valkey cache that upgrades its version with zero downtime and no data loss, on the stock image and no orchestrator — the replication hand-off lives entirely in the pod manifests (headless Service, maxSurge, an initContainer that replicates the running peer, and a preStop failover).",
               "id": "cache",
               "importPath": "github.com/metio/kurly/workloads/valkey/cache.libsonnet",
               "kind": "worker"
            },
            {
               "args": [
                  {
                     "default": "docker.io/valkey/valkey:9.0.3",
                     "name": "image",
                     "required": false,
                     "type": "string"
                  },
                  {
                     "default": "1Gi",
                     "name": "storageSize",
                     "required": false,
                     "type": "quantity"
                  }
               ],
               "help": "The single-instance Valkey server: a StatefulSet with append-only persistence into a volumeClaimTemplate. Compose + features as usual (it is a composable kurly.stateful app).",
               "id": "instance",
               "importPath": "github.com/metio/kurly/workloads/valkey/instance.libsonnet",
               "kind": "stateful"
            }
         ],
         "summary": "A persistent Valkey server (the BSD Redis fork) on the official upstream image, as a kurly.stateful workload with a per-pod PVC and a headless Service. Single-instance stage; a Redis-compatible alternative runs by overriding the image."
      }
   ]
}