Scale the agent to zero replicas without deleting the CR or PVC. status.phase becomes Suspended. Reverse by setting back to false. See Suspend an agent.
resources
corev1.ResourceRequirements
{}
Applied to the agent container directly.
nodeSelector
map[string]string
{}
Standard pod placement.
tolerations
[]corev1.Toleration
[]
Standard pod placement.
affinity
*corev1.Affinity
nil
Standard pod placement.
env
[]corev1.EnvVar
[]
Injected into the agent container AFTER per-provider and per-gateway env. Overrides those on key conflict. Operator-stamped vars (HERMES_INFERENCE_PROVIDER, field refs, identity) are appended LAST and override everything.
envFrom
[]corev1.EnvFromSource
[]
Standard envFrom.
llmDefaultProvider
string
""
Becomes HERMES_INFERENCE_PROVIDER. The CRD validates that it matches an entry in llmProviders[].name. Caveat: does not reliably switch the active provider. Upstream resolves the active provider from $HERMES_HOME/config.yaml's model.provider before falling back to this env var. Because config.yaml is seeded on first boot with a concrete value, this field is shadowed in normal use. To switch providers in practice, edit $HERMES_HOME/config.yaml on the PVC and restart; see Change the LLM provider for an agent.
Exactly one of persistentVolumeClaim or existingClaimName must be set (a CEL one-of rule enforces this).
Field
Type
Default
Description
persistentVolumeClaim
corev1.PersistentVolumeClaimSpec
{}
Native K8s PVC spec. The operator creates this PVC and mounts it at /opt/data ($HERMES_HOME). Mutually exclusive with existingClaimName.
existingClaimName
string
""
Name of a pre-existing PVC to mount. The operator does NOT create, reconcile, or own the PVC — it mounts it verbatim. retainPolicy is ignored. See Adopt a pre-existing PVC.
retainPolicy
Retain | Delete
Retain
Retain: CR delete leaves the PVC. Delete: CR delete cascades to the PVC via ownerRef GC. Ignored when existingClaimName is set.
Creates one RoleBinding per entry in the named namespace.
clusterRoleBindings
[]HermesAgentClusterRoleBinding
[]
Creates one ClusterRoleBinding per entry. Bounded by --allowed-cluster-roles allowlist. Entries referencing roles not in the allowlist fail reconciliation with RBACSynced=False.
Passed through. Auth is your responsibility: add nginx.ingress.kubernetes.io/auth-url, oauth2-proxy fronting, etc. here. See Expose the dashboard externally with auth.