FireboltEngineClass CRD reference

Spec, status, inherited Engine settings, and Firebolt Operator-owned template fields for FireboltEngineClass.

Spec reference

Every field except spec.template is an optional default that a referencing Engine inherits when it does not set the matching field itself. Resolution is always the Engine value first, then the class value, then the Firebolt Operator default. The Engine owns the value when it sets it. The class supplies it otherwise. The Firebolt Operator default sits beneath both.

Field	Required	Default	Description
spec.template	Yes	–	PodTemplateSpec merged under each Engine’s spec.template (Engine wins). See Firebolt Operator-owned fields and EngineClass configuration inheritance.
spec.uiSidecar	No	false	Default UI sidecar toggle. When it resolves to true, the Firebolt Operator injects a built-in, operator-owned nginx container named engine-web (serving the Engine Web UI, listening on port 9100) into each engine pod. The engine-web container name is reserved, so a user-supplied container or init container with that name is rejected. The container carries an HTTP readiness probe on the UI port, so the pod only reports Ready (and rollouts only promote) when the UI is actually serving. The sidecar follows the Kubernetes default pull policy for its image (Always while the UI image is tracked at :latest); an explicit imagePullPolicy on the engine container (in the engine or class template) applies to the sidecar too. The engine spec.uiSidecar wins when set.
spec.storage	No	{} (emptyDir)	Default per-pod data volume. An engine that names any backend (persistentVolumeClaim, emptyDir, or hostPath) on its own spec.storage owns it. Otherwise the class backend applies. Backend selection is whole-struct, so the three backends stay mutually exclusive. See the FireboltEngine CRD reference.
spec.customEngineConfig	No	–	Free-form config.yaml fragment deep-merged beneath each Engine’s spec.customEngineConfig. The merge order is the Firebolt Operator base, then the class, then the Engine, so an Engine key wins over the same key on the class. The Firebolt Operator strips its owned paths (schema_version, instance.*, engine.id, engine.nodes, and engine.termination_grace_period) from the class layer too, so the class cannot override identity, routing, or topology.
spec.rollout	No	graceful	Default rollout strategy, graceful or recreate. The engine spec.rollout wins when set.
spec.drainCheckEnabled	No	true	Default drain-check toggle. The engine spec.drainCheckEnabled wins when set.
spec.drainCheckInterval	No	–	Default drain-poll interval. The engine spec.drainCheckInterval wins when set.
spec.autoStop	No	–	Default auto-stop policy. This is whole-struct. An engine that sets spec.autoStop owns the entire policy with no field-merge, and the class policy applies only when the engine omits it. See the FireboltEngine CRD reference.

A class-level change to spec.uiSidecar, spec.storage, or spec.customEngineConfig reshapes the rendered engine pod, so it rolls a new blue-green generation on every bound engine. Changes to spec.rollout, spec.drainCheckEnabled, spec.drainCheckInterval, and spec.autoStop are read live and do not by themselves trigger a rollout.

Firebolt Operator-owned fields on class templates

The validating webhook rejects user input on paths the Firebolt Operator owns end-to-end. Everything else under spec.template is allowed. The same allowlist applies to FireboltEngine.spec.template.

Pod template metadata

Path	User-allowed	Notes
spec.template.metadata.labels	Yes	Keys under firebolt.io/ are rejected. Engine labels win on conflict.
spec.template.metadata.annotations	Yes	Keys under firebolt.io/ are rejected. Engine annotations win on conflict.
spec.template.metadata.{name,namespace,ownerReferences,...}	No	Assigned by the StatefulSet controller.

Pod-level fields under spec.template.spec

Path	User-allowed	Notes
serviceAccountName	Yes	Engine spec.template.spec.serviceAccountName wins.
nodeSelector	Yes	Map-merge; engine keys win.
tolerations	Yes	Class + engine, concatenated.
affinity	Yes	Engine wins if non-nil; no field-merge.
topologySpreadConstraints	Yes	Class + engine, concatenated.
priorityClassName, runtimeClassName, schedulerName	Yes	Engine wins when set.
dnsPolicy, dnsConfig	Yes	Engine wins when set.
preemptionPolicy	Yes	Engine wins when set.
readinessGates, resourceClaims, hostAliases	Yes	Class + engine, concatenated.
os, overhead	Yes	Engine wins when set.
imagePullSecrets	Yes	Class + engine, concatenated.
volumes	Yes	Firebolt Operator volumes first; class and Engine volumes appended (collisions with reserved names dropped).
securityContext	Yes	Engine wins if non-nil; Firebolt Operator fsGroup defaults always stamped.
initContainers[*]	Yes	Class + engine, concatenated. Init container named engine is rejected. May mount engine-config, data, and runtime; the Secret-backed volumes are rejected (see below).
containers[name=="engine"]	Limited	See engine container table below.
containers[name!="engine"]	Yes	Sidecars: user-owned, except the reserved engine-web name (the Firebolt Operator’s UI sidecar), which is rejected. Same volume rule as initContainers.
terminationGracePeriodSeconds	No	Hardcoded to 60s (same on engine template).
subdomain, hostname	No	Headless-DNS contract.
restartPolicy, activeDeadlineSeconds	No	StatefulSet semantics.
hostNetwork, hostPID, hostIPC, shareProcessNamespace, hostUsers	No	Isolation contract.

Engine container (containers[name=="engine"])

Field	User-allowed	Notes
image, imagePullPolicy	Yes	Engine container image wins when set on the engine.
resources	Yes	Engine wins wholesale if it sets requests/limits/claims; else class. Bounds checked on the merged value.
env	Yes	Operator-injected vars first; class then engine appended (reserved keys rejected).
envFrom	Yes	Class + engine, concatenated.
volumeMounts	Yes	Operator mounts first; class then engine (collisions dropped).
securityContext	Yes	Engine wins if non-nil.
lifecycle	Yes	Engine wins if non-nil.
workingDir	Yes	Engine wins when set.
terminationMessagePath, terminationMessagePolicy	Yes	Engine wins when set.
volumeDevices	Yes	Class + engine, concatenated.
resizePolicy	Yes	Class + engine, concatenated.
name, command, args, ports	No	Hardcoded by the Firebolt Operator.
readinessProbe, livenessProbe, startupProbe	No	/health/ready contract.
restartPolicy	No	Dropped by the kubelet on non-init containers.
stdin, stdinOnce, tty	No	Non-interactive workload.

A second container named engine is rejected because the Firebolt Operator renders that container.

Volumes a sidecar or init container may mount

Sidecars and init containers may mount the Firebolt Operator-rendered engine-config, data, and runtime volumes. Mounting the data volume from an init container is the supported way to prepare the data directory before the (non-root) engine starts — necessary with the hostPath storage backend, which the kubelet does not apply fsGroup to.

The Secret-backed volumes are rejected on any container other than the Firebolt Operator-rendered engine container: auth-admin, tls-engine, and every auth-signing-<key-id> volume. Those carry the instance admin password, the engine’s TLS private key, and the JWT signing keys, so mounting them would hand a template author credentials they cannot otherwise read.

Status properties

Field	Description
status.observedGeneration	metadata.generation last reconciled.
status.boundEngines	Count of FireboltEngine resources in this namespace referencing the class.
status.conditions[type=Ready]	True when the class can be used. False/OperatorOwnedFieldSet means the template contains a reserved field. False/DeletionBlocked means Engines still reference a class being deleted.

Short name: firengc.