# CRD Reference

# CRD Reference

Both namespaced resources use `apiVersion: sourcegateway.dev/v1alpha1` and share `spec.authorization.rules`. A rule has a unique nonempty `name`, one or more supported `operations`, and a nonempty CEL `allow` expression (maximum 4 KiB); there are at most 32 rules.

## GitRepository

| Field | Meaning |
| --- | --- |
| `spec.upstream.url` | Git smart HTTP repository URL. HTTPS is required unless the process permits that exact HTTP origin. |
| `spec.upstream.credential` | Name in runtime `credentials.gitRepository`, permitted for this namespace. |
| `spec.mirror.refreshInterval` | Positive periodic mirror refresh interval. |
| `spec.mirror.maxStaleness` | Positive maximum age that may serve reads; gateway pushes update the mirror immediately. |
| `spec.authorization.rules` | Rules using `git.read` and/or `git.push`. |

`status.path` is `/git/<namespace>/<name>.git`.

## ObjectStorageBucket

| Field | Meaning |
| --- | --- |
| `spec.backend.provider` | `s3` or `gcs`. |
| `spec.backend.endpoint` | Optional object storage API base URL. Its origin must match the selected credential's effective origin. HTTPS is required unless the process permits that exact HTTP origin. |
| `spec.backend.region` | Required for S3 and omitted for GCS. |
| `spec.backend.bucket` | Authoritative provider bucket name. |
| `spec.backend.credential` | Name in runtime `credentials.objectStorageBucket`, permitted for this namespace. |
| `spec.cache.capacity` | Positive per-source cache maximum, no greater than the global maximum. |
| `spec.cache.ttl` | Positive retention duration for cached reads; gateway writes refresh or evict affected entries. |
| `spec.authorization.rules` | Rules using the `bucket.*` and `object.*` operations. |

`status.bucketName` is the stable S3-compatible name clients use at the gateway; do not derive or replace it with the upstream bucket name.

## Shared status

`status.observedGeneration` identifies the reconciled generation, `status.policyRevision` identifies the compiled policy, and `status.conditions` contains `PolicyReady`, `CredentialsReady`, `UpstreamReady`, and `Ready`. A source is served only when `Ready=True` for its current generation.