API Reference

Packages

• runtime.wasmcloud.dev/v1alpha1

runtime.wasmcloud.dev/v1alpha1

Package v1alpha1 contains API Schema definitions for the runtime v1alpha1 API group.

Resource Types

• Artifact
• ArtifactList
• Host
• HostList
• Workload
• WorkloadDeployment
• WorkloadDeploymentList
• WorkloadList
• WorkloadReplicaSet
• WorkloadReplicaSetList

Artifact

Artifact is the Schema for the artifacts API.

Appears in:

• ArtifactList

Field	Description	Default	Validation
apiVersion string	runtime.wasmcloud.dev/v1alpha1
kind string	Artifact
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec ArtifactSpec

ArtifactList

ArtifactList contains a list of Artifact.

Field	Description	Default	Validation
apiVersion string	runtime.wasmcloud.dev/v1alpha1
kind string	ArtifactList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items Artifact array

ArtifactSpec

ArtifactSpec defines the desired state of Artifact.

Appears in:

• Artifact

Field	Description	Default	Validation
image string			Required: {}
imagePullSecret LocalObjectReference			Optional: {}

ConfigLayer

Appears in:

• HostInterface
• LocalResources

Field	Description	Default	Validation
configFrom LocalObjectReference array	ConfigFrom is a list of references to ConfigMaps that will be provided to the workload. The keys and values of all referenced ConfigMaps will be merged. In case of key conflicts, the last ConfigMap in the list wins.		Optional: {}
secretFrom LocalObjectReference array	The keys and values of all referenced Secrets will be merged. In case of key conflicts, the last Secret in the list wins. The values of the Secrets will be base64-decoded, utf-8 decoded before being provided to the workload.		Optional: {}
config object (keys:string, values:string)			Optional: {}

EphemeralVolume

EphemeralVolume represents a temporary directory that shares a workload's lifetime.

Appears in:

• Volume

Host

Host is the Schema for the Hosts API.

Appears in:

• HostList

Field	Description	Default	Validation
apiVersion string	runtime.wasmcloud.dev/v1alpha1
kind string	Host
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
hostId string			Required: {}
hostname string			Optional: {}
httpPort integer			Optional: {}
environment string	Environment records where the host is running. For Kubernetes host pods this is the pod's namespace; for out-of-cluster hosts it can be any operator-defined identifier (e.g. a region or data center).		Optional: {}

HostInterface

Appears in:

• WorkloadSpec

Field	Description	Default	Validation
configFrom LocalObjectReference array	ConfigFrom is a list of references to ConfigMaps that will be provided to the workload. The keys and values of all referenced ConfigMaps will be merged. In case of key conflicts, the last ConfigMap in the list wins.		Optional: {}
secretFrom LocalObjectReference array	The keys and values of all referenced Secrets will be merged. In case of key conflicts, the last Secret in the list wins. The values of the Secrets will be base64-decoded, utf-8 decoded before being provided to the workload.		Optional: {}
config object (keys:string, values:string)			Optional: {}
name string	Name uniquely identifies this interface instance when multiple entries share the same namespace+package. It is the (implements <name>) id the host uses to route a component's named import to this interface's backend, so two imports of the same namespace:package can resolve to different backends. Required when multiple entries of the same namespace:package exist.		MaxLength: 64 Optional: {} Pattern: ^[a-z0-9][a-z0-9-]*$
namespace string			MaxLength: 128 Required: {}
package string			MaxLength: 128 Required: {}
interfaces string array			MinItems: 1 Required: {}
version string			MaxLength: 64 Optional: {}

HostList

HostList contains a list of Host.

Field	Description	Default	Validation
apiVersion string	runtime.wasmcloud.dev/v1alpha1
kind string	HostList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items Host array

HostPathVolume

HostPathVolume represents a pre-existing file or directory on the host machine.

Appears in:

• Volume

Field	Description	Default	Validation
path string	Path of the file or directory on the host.		Required: {}

KubernetesServiceRef

KubernetesServiceRef references an existing Kubernetes Service that the operator will manage an EndpointSlice for, pointing to the host pods that are running this workload.

Appears in:

• KubernetesSpec

Field	Description	Default	Validation
name string	Name is the name of the Kubernetes Service in the same namespace.		Required: {}

KubernetesSpec

KubernetesSpec groups Kubernetes-specific configuration for a workload.

Appears in:

• WorkloadDeploymentSpec
• WorkloadSpec

Field	Description	Default	Validation
service KubernetesServiceRef	Service references an existing Kubernetes Service that the operator will maintain an EndpointSlice for, pointing to the host pods running this workload. When set, the operator also registers DNS aliases for the service (e.g. service-name, service-name.namespace.svc.cluster.local) with the host so cluster-internal callers can reach the workload via Service DNS without going through an external gateway.		Optional: {}

LocalResources

LocalResources describes resources that will be made available to a workload component.

Appears in:

• WorkloadComponent
• WorkloadService

Field	Description	Default	Validation
volumeMounts VolumeMount array	VolumeMounts is a list of volume mounts that will be mounted into the workload component. The volumes must be defined in the WorkloadSpec.Volumes field.		Optional: {}
environment ConfigLayer			Optional: {}
config object (keys:string, values:string)			Optional: {}
allowedHosts string array	AllowedHosts is the outbound egress allowlist for this component. Each entry must match one of: - "" (allow all) - "host[:port]" e.g. "example.com" or "example.com:8443" - "scheme://host[:port][/]" e.g. "https://api.example.com" or "https://api.example.com/" - ".suffix[:port]" e.g. ".example.com" or ".example.com:8443" - "scheme://.suffix[:port][/]" e.g. "https://.example.com" This is a hosts policy, not a URL policy: entries must not include a path (beyond bare /), query string, or fragment. The wildcard must be *.<rest> (leading dot required); a bare *foo is rejected. Empty or absent allowedHosts denies all outgoing requests (fail-closed). To opt into unrestricted egress, set allowedHosts:<br />["*"] explicitly. Final validation runs in the runtime. This regex is an admission-time guard, not the source of truth.		Optional: {} items:Pattern: ^\*$|^([A-Za-z][A-Za-z0-9+.-]*://)(\*\.)?[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*(:[0-9]{1,5})?/?$|^(\*\.)?[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*(:[0-9]{1,5})?$
allowedIpNameLookups string array	AllowedIPNameLookups is the set of names this component may resolve through wasi:sockets/ip-name-lookup (resolve-addresses). Each entry must match one of: - "" (resolve any name) - ".suffix" e.g. ".wasmcloud.io" - "host" e.g. "api.wasmcloud.io" - a literal IP address, e.g. "10.0.0.1" or "::1" A name is not a URL: entries must not carry a scheme, port, path, query string, or fragment. The wildcard must be ".<rest>" with a leading dot; a bare "foo" is rejected. Empty or absent allowedIpNameLookups denies every lookup, reported to the component as permanent-resolver-failure. To resolve any name, set allowedIpNameLookups: [""] explicitly. Resolution is granted separately from allowedHosts, which governs outbound connections rather than name lookups. Final validation runs in the runtime. This regex is an admission-time guard, not the source of truth.		Optional: {} items:Pattern: ^\*$|^(\*\.)?[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$|^[0-9A-Fa-f:.]+$

ReplicaSetStatus

Appears in:

• WorkloadDeploymentStatus
• WorkloadReplicaSetStatus

Field	Description	Default	Validation
expected integer			Optional: {}
current integer			Optional: {}
ready integer			Optional: {}
unavailable integer			Optional: {}

Volume

Volume represents a named volume that can be mounted by components.

Appears in:

• WorkloadSpec

Field	Description	Default	Validation
name string	Name of the volume. Must be a DNS_LABEL and unique within the Workload.		Required: {}
ephemeral EphemeralVolume	EphemeralVolume represents a temporary directory that shares a workload's lifetime.		Optional: {}
hostPath HostPathVolume	HostPathVolume represents a pre-existing file or directory on the host machine.		Optional: {}

VolumeMount

VolumeMount describes a mounting of a Volume within a component.

Appears in:

• LocalResources

Field	Description	Default	Validation
name string	Name must match the Name of a Volume defined in the WorkloadSpec.Volumes field.		Required: {}
mountPath string	MountPath is the path within the component where the volume should be mounted.		Required: {}
readOnly boolean	ReadOnly indicates whether the volume should be mounted as read-only.		Optional: {}

Workload

Workload is the Schema for the artifacts API.

Appears in:

• WorkloadList

Field	Description	Default	Validation
apiVersion string	runtime.wasmcloud.dev/v1alpha1
kind string	Workload
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec WorkloadSpec

WorkloadComponent

WorkloadComponent represents a component of a workload. Components are stateless, invocation-driven units of computation. Components are isolated from each other and can be scaled independently. Each Component has a Root WIT World, representing the Components imports/exports. The combined list of all Components' Root WIT Worlds within a workload must be compatible with the Host's WIT World. All components within a workload are guaranteed to be placed on the same Wasm Host.

Appears in:

• WorkloadSpec

Field	Description	Default	Validation
name string			Required: {}
image string			Required: {}
imagePullSecret LocalObjectReference			Optional: {}
imagePullPolicy PullPolicy			Optional: {}
poolSize integer			Optional: {}
maxInvocations integer			Optional: {}
localResources LocalResources			Optional: {}

WorkloadDeployPolicy

Underlying type: string

Appears in:

• WorkloadDeploymentSpec

Field	Description
RollingUpdate
Recreate

WorkloadDeployment

WorkloadDeployment is the Schema for the artifacts API.

Appears in:

• WorkloadDeploymentList

Field	Description	Default	Validation
apiVersion string	runtime.wasmcloud.dev/v1alpha1
kind string	WorkloadDeployment
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec WorkloadDeploymentSpec

WorkloadDeploymentArtifact

Appears in:

• WorkloadDeploymentSpec

Field	Description	Default	Validation
name string			Required: {}
artifactFrom LocalObjectReference			Required: {}

WorkloadDeploymentList

WorkloadDeploymentList contains a list of HttpTrigger.

Field	Description	Default	Validation
apiVersion string	runtime.wasmcloud.dev/v1alpha1
kind string	WorkloadDeploymentList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items WorkloadDeployment array

WorkloadDeploymentSpec

WorkloadDeploymentSpec defines the desired state of WorkloadDeployment.

Appears in:

• WorkloadDeployment

Field	Description	Default	Validation
replicas integer		1	Optional: {}
template WorkloadReplicaTemplate			Required: {}
deployPolicy WorkloadDeployPolicy		RollingUpdate	Optional: {}
artifacts WorkloadDeploymentArtifact array			Optional: {}
kubernetes KubernetesSpec	Kubernetes groups Kubernetes-specific configuration such as Service references and endpoint management.		Optional: {}

WorkloadList

WorkloadList contains a list of Workload.

Field	Description	Default	Validation
apiVersion string	runtime.wasmcloud.dev/v1alpha1
kind string	WorkloadList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items Workload array

WorkloadReplicaSet

WorkloadReplicaSet is the Schema for the artifacts API.

Appears in:

• WorkloadReplicaSetList

Field	Description	Default	Validation
apiVersion string	runtime.wasmcloud.dev/v1alpha1
kind string	WorkloadReplicaSet
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec WorkloadReplicaSetSpec

WorkloadReplicaSetList

WorkloadReplicaSetList contains a list of WorkloadReplicaSet.

Field	Description	Default	Validation
apiVersion string	runtime.wasmcloud.dev/v1alpha1
kind string	WorkloadReplicaSetList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items WorkloadReplicaSet array

WorkloadReplicaSetSpec

WorkloadReplicaSetSpec defines the desired state of WorkloadReplicaSet.

Appears in:

• WorkloadDeploymentSpec
• WorkloadReplicaSet

Field	Description	Default	Validation
replicas integer		1	Optional: {}
template WorkloadReplicaTemplate			Required: {}

WorkloadReplicaTemplate

Appears in:

• WorkloadDeploymentSpec
• WorkloadReplicaSetSpec

Field	Description	Default	Validation
annotations object (keys:string, values:string)			Optional: {}
labels object (keys:string, values:string)			Optional: {}
spec WorkloadSpec			Required: {}

WorkloadService

WorkloadService represents a long-running service that is part of the workload. It is also sometimes referred to as a "sidecar" and is optional. A Service differs from a Component in that it is long-running and represents the Workload's "localhost". Services can bind to TCP & UDP ports, which are accessible by Components within the same workload via "localhost" or "127.0.0.1". Services export a single WIT interface, shaped as wasi:cli/run. Services can import interfaces from any Component within the same workload, or from the Host.

Appears in:

• WorkloadSpec

Field	Description	Default	Validation
image string			Required: {}
imagePullSecret LocalObjectReference			Optional: {}
imagePullPolicy PullPolicy			Optional: {}
maxRestarts integer			Optional: {}
localResources LocalResources			Optional: {}

WorkloadSpec

WorkloadSpec defines the desired state of Workload.

Appears in:

• Workload
• WorkloadReplicaTemplate

Field	Description	Default	Validation
hostSelector object (keys:string, values:string)			Optional: {}
hostId string			Optional: {}
environment string	Environment, if set, scopes scheduling to Hosts whose Environment matches this value, regardless of the Workload's own namespace. The value is matched against Host.Environment — typically a Kubernetes namespace for in-cluster host pods, or any operator-defined identifier for out-of-cluster hosts (e.g. a region or data center). Only honored when the operator is started with allowSharedHosts=true, or when Environment equals the Workload's namespace.		Optional: {}
components WorkloadComponent array			Optional: {}
hostInterfaces HostInterface array	HostInterfaces declares the host-provided interfaces this workload needs. Two routing invariants are enforced at admission, complementing the host-side checks: 1. No two entries may be exact duplicates (same namespace, package, name, and version). 2. At most one entry of a given namespace:package may be unnamed — the unnamed entry is the default route and cannot be shared. Declare distinct names to route multiple imports of the same package to different backends. Semver-incompatible versions of the same package may coexist (they are distinct interfaces).		MaxItems: 64 Optional: {}
service WorkloadService			Optional: {}
volumes Volume array			Optional: {}
kubernetes KubernetesSpec	Kubernetes groups Kubernetes-specific configuration such as Service references and endpoint management.		Optional: {}