Platform Task Reference

A PlatformTask provisions the namespace envelope a run-to-completion workload needs — ServiceAccount, image-pull credentials, cloud identity, secrets, networking, and cloud resources — and creates no workload of its own. You supply the CronJob, Job, or Argo Workflow yourself. See Non-Web Workloads for when to reach for this instead of a PlatformApplication, and for a complete worked example.

No scheduling fields

There is no schedule, type, trigger, or runtime field on this CRD. The schedule lives on your own CronJob. Fields not listed below are rejected on apply — kubectl apply returns a strict decoding error naming each unknown field, and ArgoCD's server-side apply reports field not declared in schema.

Auto-generated derived type for PlatformTaskSpec via CustomResource

Name	Type	Description	Required
apiVersion	string	meta.p6m.dev/v1alpha1	true
kind	string	PlatformTask	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		true
status	object		false

spec

Name	Type	Description	Required
argo	object		false
config	map[string]string		false
metaflow	object		false
networking	object		false
resources	map[string][]object		false
secrets	[]object		false

spec.argo

^{↩ Parent}

Name	Type	Description	Required
sources	object		false
triggers	[]object		false

spec.argo.sources

^{↩ Parent}

Name	Type	Description	Required
sqs	[]object		false

spec.argo.sources.sqs[index]

^{↩ Parent}

Name	Type	Description	Required
name	string		true
queueName	string		true
region	string		true

spec.metaflow

^{↩ Parent}

Name	Type	Description	Required
enabled	boolean		true

spec.networking

^{↩ Parent}

Name	Type	Description	Required
inbound	object	Inbound access policy: list of services allowed to access this application. Used to generate Istio/network policies. If not specified, all traffic is allowed.	false
ingress	object	Ingress configuration for exposing the application to external traffic (internet or internal networks)	false
outbound	object	Outbound access policy: list of services and external hosts this application is allowed to access. Used to generate Istio/network policies. If not specified, all traffic is allowed.	false

spec.networking.inbound

^{↩ Parent}

Inbound access policy: list of services allowed to access this application. Used to generate Istio/network policies. If not specified, all traffic is allowed.

Name	Type	Description	Required
services	[]object	List of services allowed to access this application. Generates Istio/network policies to enforce access. If not specified, all inbound traffic to the service is allowed.	false

spec.networking.inbound.services[index]

^{↩ Parent}

Name	Type	Description	Required
name	string	Kubernetes service name allowed to access this application	true
namespace	string	Kubernetes namespace of the source service. Should be explicitly specified; if omitted, will use the service name as namespace as well.	false
port	integer	Port on this application to allow the service to access (1-65535). If not specified, all ports are allowed. Format: int32 Minimum: 1 Maximum: 65535	false

spec.networking.ingress

^{↩ Parent}

Ingress configuration for exposing the application to external traffic (internet or internal networks)

Name	Type	Description	Required
annotations	map[string]string	Additional AWS ALB (Application Load Balancer) annotations for the Kubernetes Ingress resource. Only applied when using AWS cloud provider with Kubernetes ingress type (not Istio/Gateway API). See: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/guide/ingress/annotations/	false
authentication	enum	RESERVED: Authentication requirement for standard methods (Required or Anonymous). Not currently implemented. Use jwt_authentication: true for JWT-based authentication. When neither field is specified, the ingress allows anonymous access. Enum: Required, Anonymous	false
cdn	object	CDN configuration for caching and serving content globally. When enabled, requests route through the CDN before reaching the origin.	false
certificate	object	Certificate configuration for custom gateway (TLS/SSL). Required when using a custom domain or custom gateway.	false
enabled	boolean	Whether to expose the application externally via an ingress/load balancer. When disabled, the application is only accessible within the cluster.	false
gateway	string	Specific Istio gateway to use for this ingress, or omit to use the cluster default gateway. Used to route through custom gateways.	false
hostnamePrefix	string	Prefix to prepend to the auto-generated default hostname (e.g., "staging" + "myapp" = "staging-myapp.platform.domain"). Ignored if custom hostnames are specified.	false
hostnames	[]string	List of fully qualified domain names (FQDNs) to register for this application (e.g., ["app.example.com", "app-alt.example.com"]). Requires DNS records to be created externally.	false
internal	boolean	Whether the application should only be internally accessible via the ingress (only applies with custom gateway). When true, no external IP is assigned.	false
jwtAuthentication	boolean	Enable JWT token authentication. Requests must include valid JWT tokens in the Authorization header.	false
oidc	boolean	Enable OpenID Connect (OIDC) authentication. Requests must provide valid OIDC credentials to access the application.	false
originRequestRestriction	object	Restrictions on origin requests. HTTP requests to the origin will return a 404 unless they match the specified headers. Used to prevent direct backend access.	false
path	string	Path prefix to forward to the backend (e.g., "/api" will route "/api/*" to the application). Used for routing to specific endpoints.	false
pathRewrite	string	Path to rewrite requests to before sending to the backend (e.g., "/api" -> "/" will strip the prefix). Used for path manipulation.	false
tld	string	Custom top-level domain (TLD) for this application instead of the cluster default (e.g., "mycompany.com"). Only applies when using custom gateway.	false
type	enum	Ingress implementation type: "istio" (Istio VirtualService/Gateway) or "kubernetes" (standard Kubernetes Ingress). Defaults based on cluster configuration. Enum: istio, kubernetes	false
visibility	enum	Load balancer visibility: PublicIP (internet-routable) or PrivateIP (internal only). Defaults based on cluster configuration. Enum: PublicIP, PrivateIP	false

spec.networking.ingress.cdn

^{↩ Parent}

CDN configuration for caching and serving content globally. When enabled, requests route through the CDN before reaching the origin.

Name	Type	Description	Required
domains	[]string	DEPRECATED: Use PlatformEdge.meta.p6m.dev CRD instead. List of domains that should be served via the CDN (e.g., ["app.example.com"]).	false
enabled	boolean	Whether CDN caching is enabled for this ingress. Set to true to cache responses or false for direct origin access. If not specified, defaults based on 'required' field.	false
required	boolean	Whether CDN is required for this ingress (forces CDN to be active even if 'enabled' is not set). Useful for ensuring CDN is always in the path.	false
wafId	string	DEPRECATED: Use PlatformEdge.meta.p6m.dev CRD instead. AWS WAF (Web Application Firewall) ID to attach to the CloudFront distribution for security.	false
zoneId	string	DEPRECATED: Use PlatformEdge.meta.p6m.dev CRD instead. AWS Route53 hosted zone ID for managing DNS records for CDN domains.	false

spec.networking.ingress.certificate

^{↩ Parent}

Certificate configuration for custom gateway (TLS/SSL). Required when using a custom domain or custom gateway.

Name	Type	Description	Required
externalSecret	object	Fetch certificate from cloud provider secret store (AWS Secrets Manager, Azure Key Vault) via ExternalSecrets operator	false
secretRef	object	Reference to an existing Kubernetes secret containing the TLS certificate and private key	false

spec.networking.ingress.certificate.externalSecret

^{↩ Parent}

Fetch certificate from cloud provider secret store (AWS Secrets Manager, Azure Key Vault) via ExternalSecrets operator

Name	Type	Description	Required
format	enum	Format of the certificate: 'pkcs12' (binary format) or 'pem' (text format). Determines how the certificate is extracted and converted. Enum: pkcs12, pem	true
secretName	string	Name of the secret in the cloud provider (AWS Secrets Manager, Azure Key Vault, etc.)	true
secretStore	string	Name of an existing ExternalSecrets SecretStore resource in the cluster that knows how to authenticate with your cloud provider	true

spec.networking.ingress.certificate.secretRef

^{↩ Parent}

Reference to an existing Kubernetes secret containing the TLS certificate and private key

Name	Type	Description	Required
name	string	Name of the Kubernetes secret containing the TLS certificate and key (usually in tls.crt and tls.key keys)	true
namespace	string	Namespace where the secret is located. Defaults to the application's namespace if not specified.	false

spec.networking.ingress.originRequestRestriction

^{↩ Parent}

Restrictions on origin requests. HTTP requests to the origin will return a 404 unless they match the specified headers. Used to prevent direct backend access.

Name	Type	Description	Required
headers	[]object	HTTP headers that must be present and match for the request to reach the origin. Requests without matching headers receive HTTP 404. Useful for protecting the origin from direct access.	false

spec.networking.ingress.originRequestRestriction.headers[index]

^{↩ Parent}

Name	Type	Description	Required
name	string	HTTP header name to match (e.g., "Authorization", "X-Custom-Header")	true
value	string	Expected header value (exact string or regex pattern depending on type)	true
type	enum	Match type: "Exact" for exact string match or "Regex" for regular expression pattern matching. Default: Exact Enum: Exact, Regex Default: Exact	false

spec.networking.outbound

^{↩ Parent}

Outbound access policy: list of services and external hosts this application is allowed to access. Used to generate Istio/network policies. If not specified, all traffic is allowed.

Name	Type	Description	Required
external	[]object	List of external services (outside the cluster) this application is allowed to access by hostname and port. Generates ServiceEntry and network policies.	false
services	[]object	List of in-cluster services this application is allowed to access. Generates Istio/network policies to enforce access. If not specified, all outbound traffic is allowed.	false

spec.networking.outbound.external[index]

^{↩ Parent}

Name	Type	Description	Required
host	string	Hostname or FQDN of the external service this application can access (e.g., "api.example.com", "database.provider.com")	true
port	integer	Port number on the external service to allow access to (1-65535) Format: int32 Minimum: 1 Maximum: 65535	true
protocol	enum	Protocol of the external service connection (HTTP, HTTPS, gRPC, TCP, TLS, etc.). Affects how the connection is handled by the service mesh. Enum: HTTP, HTTPS, GRPC, HTTP2, MONGO, TCP, TLS	false

spec.networking.outbound.services[index]

^{↩ Parent}

Name	Type	Description	Required
name	string	Kubernetes service name this application is allowed to access	true
namespace	string	Kubernetes namespace of the destination service. If not specified, assumes the same namespace as this application.	false
port	integer	Port on the destination service to allow access to (1-65535). If not specified, all ports are allowed. Format: int32 Minimum: 1 Maximum: 65535	false

spec.resources[key][index]

^{↩ Parent}

Name	Type	Description	Required
name	string	Name of the cloud resource to grant access to. Must match an existing resource provisioned in your cloud environment.	true
accesses	[]string	List of access permissions to grant on this resource. Available access types depend on the specific Crossplane composition. Common examples include "read", "write", "admin". Leave empty for default access level defined by the composition.	false

spec.secrets[index]

^{↩ Parent}

Name	Type	Description	Required
name	string	Name of the secret in the cloud secret store (e.g., AWS Secrets Manager, Azure Key Vault). The secret must be stored as key-value pairs and will be injected into the pod as environment variables (keys become variable names).	true
admins	[]string	Optional list of user identifiers (e.g., email addresses) who can administer/rotate this secret in the cloud secret store.	false

status

Name	Type	Description	Required
cloud	object		false
conditions	[]object		false
managedResources	[]object		false
phase	enum	Enum: pending, progressing, ready, failed	false

status.cloud

^{↩ Parent}

Name	Type	Description	Required
keyVaultName	string	The name of the provisioned Azure Key Vault resource.	false
principalId	string	The Azure Workload Identity object (principal) ID assigned to the task.	false
role	string	The AWS IAM role ARN assigned to the task via IRSA (IAM Roles for Service Accounts).	false

status.conditions[index]

^{↩ Parent}

Name	Type	Description	Required
status	string		true
type	string		true
lastTransitionTime	string		false
message	string		false
reason	string		false

status.managedResources[index]

^{↩ Parent}

ObjectReference contains enough information to let you inspect or modify the referred object.

Name	Type	Description	Required
apiVersion	string	API version of the referent.	false
fieldPath	string	If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object.	false
kind	string	Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds	false
message	string		false
name	string	Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names	false
namespace	string	Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/	false
phase	enum	Enum: pending, progressing, ready, failed	false
resourceVersion	string	Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency	false
uid	string	UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids	false