These schemas are generated from the Rust types in crates/rise-resource-api/ and are byte-identical across runs. They are regenerated and verified in CI via:
Terminal window
miserunresource:schema:generate
miserunresource:schema:check
The raw JSON files live under /operator-docs/schemas/ (linked from each section). Tooling can consume them directly: JSON Schema Draft 2020-12.
The wire envelope for any resource — built-in or external. spec and status are generic (kind-specific shapes are validated by typed validators for built-ins and JSON Schema for external custom resources).
Every label key in force on this resource, resolved nearest-wins down its
ancestry (ADR-0001 §6.1).
Computed on read from the ancestor chain, never stored: this is the same
walk authorization performs, so the value a client sees and the value a
`labelSelector` matches can never disagree. Responses built without an
ancestor chain leave it empty rather than repeating `labels`, which would
claim an inheritance answer nobody resolved.
finalizers
array<string>
no
default: []
labels
object<string, string>
no
Targeting metadata. A key becomes access-relevant exactly when some
policy binding's `labelSelector` references it (ADR-0001 §6.1); no key
carries authorization meaning on its own.
Standard metadata fields common to every resource. The fields uid, revision, discriminator, and deletionTimestamp are server-controlled (rejected on create; only revision is required on update).
Every label key in force on this resource, resolved nearest-wins down its
ancestry (ADR-0001 §6.1).
Computed on read from the ancestor chain, never stored: this is the same
walk authorization performs, so the value a client sees and the value a
`labelSelector` matches can never disagree. Responses built without an
ancestor chain leave it empty rather than repeating `labels`, which would
claim an inheritance answer nobody resolved.
finalizers
array<string>
no
default: []
labels
object<string, string>
no
Targeting metadata. A key becomes access-relevant exactly when some
policy binding's `labelSelector` references it (ADR-0001 §6.1); no key
carries authorization meaning on its own.
The built-in Organization resource — root-scoped (apiVersion: rise.dev/v1alpha1, kind: Organization). spec.deploymentControllerClass is the controller identifier that owns this org’s deployments; the Kubernetes controller reconciles only orgs whose value matches its configured controller_class_name. The default organization additionally carries an annotation kubernetes.rise.dev/namespace-prefix that the Kubernetes controller uses to build per-project namespace names.
Every label key in force on this resource, resolved nearest-wins down its
ancestry (ADR-0001 §6.1).
Computed on read from the ancestor chain, never stored: this is the same
walk authorization performs, so the value a client sees and the value a
`labelSelector` matches can never disagree. Responses built without an
ancestor chain leave it empty rather than repeating `labels`, which would
claim an inheritance answer nobody resolved.
finalizers
array<string>
no
default: []
labels
object<string, string>
no
Targeting metadata. A key becomes access-relevant exactly when some
policy binding's `labelSelector` references it (ADR-0001 §6.1); no key
carries authorization meaning on its own.
The built-in ResourceDefinition resource that registers custom resource kinds. Identity fields (group, kind, plural, parent) become immutable once instances exist. See Custom Resources for the registration flow and version lifecycle.
The resource is root-scoped when this is absent; otherwise it must live
under a parent of the referenced API group and kind.
plural
string
yes
versions
array<ResourceDefinitionVersion>
yes
ResourceDefinitionStatus
Field
Type
Required
Description
controllers
object<string, any>
no
ResourceDefinitionVersion
Field
Type
Required
Description
name
string
yes
schema
any
no
served
boolean
yes
storage
boolean
yes
ResourceMetadata
Field
Type
Required
Description
annotations
object<string, string>
no
default: {}
deletionTimestamp
string | null
no
discriminator
string | null
no
effectiveLabels
object<string, string>
no
Every label key in force on this resource, resolved nearest-wins down its
ancestry (ADR-0001 §6.1).
Computed on read from the ancestor chain, never stored: this is the same
walk authorization performs, so the value a client sees and the value a
`labelSelector` matches can never disagree. Responses built without an
ancestor chain leave it empty rather than repeating `labels`, which would
claim an inheritance answer nobody resolved.
finalizers
array<string>
no
default: []
labels
object<string, string>
no
Targeting metadata. A key becomes access-relevant exactly when some
policy binding's `labelSelector` references it (ADR-0001 §6.1); no key
carries authorization meaning on its own.
These are generated by separate commands (backend config-schema, backend rise-toml-schema), not by backend schemas generate. They are kept separate to avoid two code paths for the same artifact.