> ## Documentation Index > Fetch the complete documentation index at: https://firebolt-aggregate-helm-docs-pr-79.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # FireboltEngineClass CRD reference > Spec, status, inherited Engine settings, and Firebolt Operator-owned template fields for FireboltEngineClass. ## Spec reference Every field except `spec.template` is an optional default that a referencing Engine inherits when it does not set the matching field itself. Resolution is always the Engine value first, then the class value, then the Firebolt Operator default. The Engine owns the value when it sets it. The class supplies it otherwise. The Firebolt Operator default sits beneath both. | Field | Required | Default | Description | | ------------------------- | -------- | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `spec.template` | **Yes** | – | [`PodTemplateSpec`](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-template-v1/) merged under each Engine's `spec.template` (Engine wins). See [Firebolt Operator-owned fields](#firebolt-operator-owned-fields-on-class-templates) and [EngineClass configuration inheritance](../engineclass/configuration-inheritance). | | `spec.uiSidecar` | No | `false` | Default UI sidecar toggle. When it resolves to `true`, the Firebolt Operator injects a built-in, operator-owned `nginx` container named `engine-web` (serving the Engine Web UI, listening on port `9100`) into each engine pod. The `engine-web` container name is reserved, so a user-supplied container or init container with that name is rejected. The container carries an HTTP readiness probe on the UI port, so the pod only reports Ready (and rollouts only promote) when the UI is actually serving. The sidecar follows the Kubernetes default pull policy for its image (`Always` while the UI image is tracked at `:latest`); an explicit `imagePullPolicy` on the `engine` container (in the engine or class template) applies to the sidecar too. The engine `spec.uiSidecar` wins when set. | | `spec.storage` | No | `{}` (emptyDir) | Default per-pod data volume. An engine that names any backend (`persistentVolumeClaim`, `emptyDir`, or `hostPath`) on its own `spec.storage` owns it. Otherwise the class backend applies. Backend selection is whole-struct, so the three backends stay mutually exclusive. See the [FireboltEngine CRD reference](./engine-crd-reference). | | `spec.customEngineConfig` | No | – | Free-form `config.yaml` fragment deep-merged beneath each Engine's `spec.customEngineConfig`. The merge order is the Firebolt Operator base, then the class, then the Engine, so an Engine key wins over the same key on the class. The Firebolt Operator strips its owned paths (`schema_version`, `instance.*`, `engine.id`, `engine.nodes`, and `engine.termination_grace_period`) from the class layer too, so the class cannot override identity, routing, or topology. | | `spec.rollout` | No | `graceful` | Default rollout strategy, `graceful` or `recreate`. The engine `spec.rollout` wins when set. | | `spec.drainCheckEnabled` | No | `true` | Default drain-check toggle. The engine `spec.drainCheckEnabled` wins when set. | | `spec.drainCheckInterval` | No | – | Default drain-poll interval. The engine `spec.drainCheckInterval` wins when set. | | `spec.autoStop` | No | – | Default auto-stop policy. This is whole-struct. An engine that sets `spec.autoStop` owns the entire policy with no field-merge, and the class policy applies only when the engine omits it. See the [FireboltEngine CRD reference](./engine-crd-reference). | A class-level change to `spec.uiSidecar`, `spec.storage`, or `spec.customEngineConfig` reshapes the rendered engine pod, so it rolls a new blue-green generation on every bound engine. Changes to `spec.rollout`, `spec.drainCheckEnabled`, `spec.drainCheckInterval`, and `spec.autoStop` are read live and do not by themselves trigger a rollout. ## Firebolt Operator-owned fields on class templates The validating webhook rejects user input on paths the Firebolt Operator owns end-to-end. Everything else under `spec.template` is allowed. The same allowlist applies to `FireboltEngine.spec.template`. ### Pod template metadata | Path | User-allowed | Notes | | ------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------- | | `spec.template.metadata.labels` | Yes | Keys under `firebolt.io/` are **rejected**. Engine labels win on conflict. | | `spec.template.metadata.annotations` | Yes | Keys under `firebolt.io/` are **rejected**. Engine annotations win on conflict. | | `spec.template.metadata.{name,namespace,ownerReferences,...}` | No | Assigned by the StatefulSet controller. | ### Pod-level fields under `spec.template.spec` | Path | User-allowed | Notes | | ------------------------------------------------------------------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `serviceAccountName` | Yes | Engine `spec.template.spec.serviceAccountName` wins. | | `nodeSelector` | Yes | Map-merge; engine keys win. | | `tolerations` | Yes | Class + engine, concatenated. | | `affinity` | Yes | Engine wins if non-nil; no field-merge. | | `topologySpreadConstraints` | Yes | Class + engine, concatenated. | | `priorityClassName`, `runtimeClassName`, `schedulerName` | Yes | Engine wins when set. | | `dnsPolicy`, `dnsConfig` | Yes | Engine wins when set. | | `preemptionPolicy` | Yes | Engine wins when set. | | `readinessGates`, `resourceClaims`, `hostAliases` | Yes | Class + engine, concatenated. | | `os`, `overhead` | Yes | Engine wins when set. | | `imagePullSecrets` | Yes | Class + engine, concatenated. | | `volumes` | Yes | Firebolt Operator volumes first; class and Engine volumes appended (collisions with reserved names dropped). | | `securityContext` | Yes | Engine wins if non-nil; Firebolt Operator `fsGroup` defaults always stamped. | | `initContainers[*]` | Yes | Class + engine, concatenated. Init container named `engine` is **rejected**. May mount `engine-config`, `data`, and `runtime`; the Secret-backed volumes are **rejected** (see below). | | `containers[name=="engine"]` | Limited | See engine container table below. | | `containers[name!="engine"]` | Yes | Sidecars: user-owned, except the reserved `engine-web` name (the Firebolt Operator's UI sidecar), which is rejected. Same volume rule as `initContainers`. | | `terminationGracePeriodSeconds` | **No** | Hardcoded to 60s (same on engine template). | | `subdomain`, `hostname` | **No** | Headless-DNS contract. | | `restartPolicy`, `activeDeadlineSeconds` | **No** | StatefulSet semantics. | | `hostNetwork`, `hostPID`, `hostIPC`, `shareProcessNamespace`, `hostUsers` | **No** | Isolation contract. | ### Engine container (`containers[name=="engine"]`) | Field | User-allowed | Notes | | ---------------------------------------------------- | ------------ | -------------------------------------------------------------------------------------------------------- | | `image`, `imagePullPolicy` | Yes | Engine container image wins when set on the engine. | | `resources` | Yes | Engine wins wholesale if it sets requests/limits/claims; else class. Bounds checked on the merged value. | | `env` | Yes | Operator-injected vars first; class then engine appended (reserved keys **rejected**). | | `envFrom` | Yes | Class + engine, concatenated. | | `volumeMounts` | Yes | Operator mounts first; class then engine (collisions dropped). | | `securityContext` | Yes | Engine wins if non-nil. | | `lifecycle` | Yes | Engine wins if non-nil. | | `workingDir` | Yes | Engine wins when set. | | `terminationMessagePath`, `terminationMessagePolicy` | Yes | Engine wins when set. | | `volumeDevices` | Yes | Class + engine, concatenated. | | `resizePolicy` | Yes | Class + engine, concatenated. | | `name`, `command`, `args`, `ports` | **No** | Hardcoded by the Firebolt Operator. | | `readinessProbe`, `livenessProbe`, `startupProbe` | **No** | `/health/ready` contract. | | `restartPolicy` | **No** | Dropped by the kubelet on non-init containers. | | `stdin`, `stdinOnce`, `tty` | **No** | Non-interactive workload. | A second container named `engine` is **rejected** because the Firebolt Operator renders that container. ### Volumes a sidecar or init container may mount Sidecars and init containers may mount the Firebolt Operator-rendered `engine-config`, `data`, and `runtime` volumes. Mounting the `data` volume from an init container is the supported way to prepare the data directory before the (non-root) engine starts — necessary with the `hostPath` storage backend, which the kubelet does not apply `fsGroup` to. The Secret-backed volumes are **rejected** on any container other than the Firebolt Operator-rendered `engine` container: `auth-admin`, `tls-engine`, and every `auth-signing-` volume. Those carry the instance admin password, the engine's TLS private key, and the JWT signing keys, so mounting them would hand a template author credentials they cannot otherwise read. ## Status properties | Field | Description | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `status.observedGeneration` | `metadata.generation` last reconciled. | | `status.boundEngines` | Count of `FireboltEngine` resources in this namespace referencing the class. | | `status.conditions[type=Ready]` | `True` when the class can be used. `False/OperatorOwnedFieldSet` means the template contains a reserved field. `False/DeletionBlocked` means Engines still reference a class being deleted. | Short name: `firengc`.