Pomerium-specific parameters should be configured via the `ingress.pomerium.io/Pomerium` CRD. The default Pomerium deployment is listening to the CRD `global`, that may be customized via command line parameters.

Pomerium posts updates to the CRD <a href="#status">`/status`</a>:

```shell
kubectl describe pomerium
```

Kubernetes-specific deployment parameters should be added via `kustomize` to the manifests.

## Spec

PomeriumSpec defines Pomerium-specific configuration parameters.

### `authenticate`

Authenticate sets authenticate service parameters. If not specified, a Pomerium-hosted authenticate service would be used.

### `certificateAutoProvision`

CertificateAutoProvision sets the certificate auto provision settings. This is a fallback for routes that are not defined via Ingress or Gateway resources. When configured, cert-manager certificate resources will be created for any routes which have no matching TLS certificate.

### `circuitBreakerThresholds`

CircuitBreakerThresholds sets the circuit breaker thresholds settings.

### `cookie`

Cookie defines Pomerium session cookie options.

### `dataBroker`

DataBroker sets the databroker settings.

### `dns`

DNS sets the dns settings.

### `downstreamMtls`

DownstreamMTLS sets the <a href="https://www.pomerium.com/docs/reference/downstream-mtls-settings">Downstream MTLS Settings</a>.

### `file`

File specifies file storage options.

### `identityProvider`

IdentityProvider configure single-sign-on authentication and user identity details by integrating with your <a href="https://www.pomerium.com/docs/identity-providers/">Identity Provider</a>

### `matchSubjectAltNames`

Match Subject Alt Names can be used to add an additional constraint when validating client certificates.

### `otel`

OTEL sets the <a href="https://www.pomerium.com/docs/reference/tracing">OpenTelemetry Tracing</a>.

### `postgres`

Postgres specifies PostgreSQL database connection parameters

### `refreshDirectory`

RefreshDirectory is no longer supported, please see <a href="https://docs.pomerium.com/docs/overview/upgrading#idp-directory-sync">Upgrade Guide</a>.

### `ssh`

SSH sets the ssh settings.

### `storage`

Storage defines persistent storage for sessions and other data. See <a href="https://www.pomerium.com/docs/internals/data-storage">Storage</a> for details. If no storage is specified, Pomerium would use a transient in-memory storage (not recommended for production).

### `timeouts`

Timeout specifies the <a href="https://www.pomerium.com/docs/reference/global-timeouts">global timeouts</a> for all routes.

## Status

PomeriumStatus represents configuration and Ingress status.

### `certificateAutoProvisionStatus`

Status of certificate auto provisioning.

### `ingress`

ResourceStatus represents the outcome of the latest attempt to reconcile relevant Kubernetes resource with Pomerium.

### `settingsStatus`

SettingsStatus represent most recent main configuration reconciliation status.