API Reference

Packages:

pkg.internal/v1beta1

pkg.internal/v1beta1

Resource Types:

Datalab

Datalab

A Datalab is a tenant-facing, namespaced composite resource. It defines ownership, membership, and optional file bundles to materialize in the environment.

Name	Type	Description	Required
apiVersion	string	pkg.internal/v1beta1	true
kind	string	Datalab	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	Desired configuration of the datalab.	true
status	object	Current observed state of the datalab.	false

Datalab.spec

^{^{↩ Parent}}

Desired configuration of the datalab.

Name	Type	Description	Required
users	[]string	Users associated with this datalab. Default: []	true
files	[]object	File bundles to fetch from remote sources and copy into the environment. Supports image, git, and http sources, path filtering, and optional credentials. Default: []	false
quota	object	Optional per-datalab session quota overrides. If a field is not specified here, the composition falls back to EnvironmentConfig at `spec.defaults.quota`, and then to hard defaults. Effective defaults (when neither XR nor EnvironmentConfig provides a value): memory=2Gi, storage=1Gi, budget=medium.	false
secretName	string	Name of the Secret containing the credentials to access the storage associated with this Datalab. The Secret must exist in the same namespace as the Datalab.	false
security	object	Optional per-datalab session security settings. If a field is not specified here, the composition falls back to EnvironmentConfig at `spec.defaults.security`, and then to hard defaults. Effective defaults (when neither XR nor EnvironmentConfig provides a value): policy=baseline, kubernetesAccess=true, kubernetesRole=edit. When policy is "privileged", Docker is automatically enabled with 20Gi storage.	false
sessions	[]string	Sessions to be started for this datalab. Default: []	false
vcluster	boolean	Whether to provision an isolated vcluster for each datalab session. Default: false	false

Datalab.spec.files[index]

^{^{↩ Parent}}

Name	Type	Description	Required
excludePaths	[]string	Glob patterns to exclude from the source.	false
git	object	Git repository source configuration.	false
http	object	HTTP source configuration for downloading an asset or archive.	false
image	object	Container image source configuration.	false
includePaths	[]string	Glob patterns to include from the source.	false
newRootPath	string	Subdirectory within the source to treat as the root.	false
path	string	Destination directory for extracted files. Default: .	false

Datalab.spec.files[index].git

^{^{↩ Parent}}

Git repository source configuration.

Name	Type	Description	Required
lfsSkipSmudge	boolean	If true, do not fetch Git LFS objects.	false
ref	string	Branch, tag, or commit to fetch.	false
refSelection	object	Resolve an explicit ref by semver selection.	false
secretRef	object	Optional credentials for the Git server.	false
url	string	Git repository URL (HTTPS or SSH).	false
verification	object	GPG signature verification options.	false

Datalab.spec.files[index].git.refSelection

^{^{↩ Parent}}

Resolve an explicit ref by semver selection.

Name	Type	Description	Required
semver	object		false

Datalab.spec.files[index].git.refSelection.semver

^{^{↩ Parent}}

Name	Type	Description	Required
constraints	string		false
prereleases	object		false

Datalab.spec.files[index].git.refSelection.semver.prereleases

^{^{↩ Parent}}

Name	Type	Description	Required
identifiers	[]string		false

Datalab.spec.files[index].git.secretRef

^{^{↩ Parent}}

Optional credentials for the Git server.

Name	Type	Description	Required
name	string	Name of a Secret with auth (ssh-privatekey/knownhosts or username/password).	false
namespace	string	Namespace of the Secret.	false

Datalab.spec.files[index].git.verification

^{^{↩ Parent}}

GPG signature verification options.

Name	Type	Description	Required
publicKeysSecretRef	object		false

Datalab.spec.files[index].git.verification.publicKeysSecretRef

^{^{↩ Parent}}

Name	Type	Description	Required
name	string	Secret containing GPG public keys.	false
namespace	string	Namespace of the Secret.	false

Datalab.spec.files[index].http

^{^{↩ Parent}}

HTTP source configuration for downloading an asset or archive.

Name	Type	Description	Required
secretRef	object	Optional basic-auth credentials for the HTTP server.	false
sha256	string	Optional checksum for verification of the downloaded asset.	false
url	string	HTTP(S) URL to file or archive; archives are unpacked automatically.	false

Datalab.spec.files[index].http.secretRef

^{^{↩ Parent}}

Optional basic-auth credentials for the HTTP server.

Name	Type	Description	Required
name	string	Secret containing username/password.	false
namespace	string	Namespace of the Secret.	false

Datalab.spec.files[index].image

^{^{↩ Parent}}

Container image source configuration.

Name	Type	Description	Required
dangerousSkipTLSVerify	boolean	Skip TLS verification when pulling from the registry.	false
secretRef	object	Optional credentials for the image registry.	false
tagSelection	object	Optional semantic-version tag selection policy.	false
url	string	OCI image reference (e.g., ghcr.io/org/repo:tag or @sha256:...).	false

Datalab.spec.files[index].image.secretRef

^{^{↩ Parent}}

Optional credentials for the image registry.

Name	Type	Description	Required
name	string	Name of a Secret containing registry credentials.	false
namespace	string	Namespace of the Secret.	false

Datalab.spec.files[index].image.tagSelection

^{^{↩ Parent}}

Optional semantic-version tag selection policy.

Name	Type	Description	Required
semver	object		false

Datalab.spec.files[index].image.tagSelection.semver

^{^{↩ Parent}}

Name	Type	Description	Required
constraints	string	Semver constraint string.	false
prereleases	object		false

Datalab.spec.files[index].image.tagSelection.semver.prereleases

^{^{↩ Parent}}

Name	Type	Description	Required
identifiers	[]string		false

Datalab.spec.quota

^{^{↩ Parent}}

Optional per-datalab session quota overrides. If a field is not specified here, the composition falls back to EnvironmentConfig at spec.defaults.quota, and then to hard defaults. Effective defaults (when neither XR nor EnvironmentConfig provides a value): memory=2Gi, storage=1Gi, budget=medium.

Name	Type	Description	Required
budget	enum	Namespace budget class determining available compute resources. Accepted values correspond to standard Educates resource budgets. Effective default (if not set here or in EnvironmentConfig): "medium". Enum: small, medium, large, x-large, xx-large, xxx-large	false
memory	string	Memory request for the session environment as a Kubernetes quantity (e.g., "2Gi", "512Mi"). Effective default (if not set here or in EnvironmentConfig): "2Gi".	false
storage	string	Storage size for the session as a Kubernetes quantity (e.g., "1Gi"). Effective default (if not set here or in EnvironmentConfig): "1Gi".	false

Datalab.spec.security

^{^{↩ Parent}}

Optional per-datalab session security settings. If a field is not specified here, the composition falls back to EnvironmentConfig at spec.defaults.security, and then to hard defaults. Effective defaults (when neither XR nor EnvironmentConfig provides a value): policy=baseline, kubernetesAccess=true, kubernetesRole=edit. When policy is "privileged", Docker is automatically enabled with 20Gi storage.

Name	Type	Description	Required
kubernetesAccess	boolean	Whether a Kubernetes service account token should be made available within the session. Effective default (if not set here or in EnvironmentConfig): true.	false
kubernetesRole	enum	Session namespace RBAC role. Accepted values: "admin", "edit", "view". Effective default (if not set here or in EnvironmentConfig): "edit". Enum: admin, edit, view	false
policy	enum	Pod Security Standard policy level. Accepted values: "restricted", "baseline", "privileged". Effective default (if not set here or in EnvironmentConfig): "baseline". Enum: restricted, baseline, privileged	false

Datalab.status

^{^{↩ Parent}}

Current observed state of the datalab.

Name	Type	Description	Required
sessions	map[string]object	Map of session IDs and their current state.	false

Datalab.status.sessions[key]

^{^{↩ Parent}}

Observed state of a single datalab session.

Name	Type	Description	Required
url	string	Public URL of the active session.	false