Garage Kubernetes Operator¶
Run Garage—distributed, self-hosted S3-compatible object storage—as a Kubernetes-native service. The operator owns cluster lifecycle, Garage layout, storage identity, gateways, buckets, credentials, and safe day-2 changes.
Storage that survives change¶
PVC-backed members, manual GarageNode resources, and node-local HostPath pools retain the Garage identity and coordinate layout changes before workloads move.
Gateways where clients are¶
Run persistent-identity gateways beside storage, at the edge, or as a management handle for an existing Garage deployment.
Kubernetes-native access¶
Provision buckets, S3 keys, admin tokens, aliases, quotas, lifecycle rules, websites, and optional COSI resources declaratively.
Operator-grade safety¶
Admission webhooks, leader election, layout coordination, drain barriers, identity pins, status conditions, and Prometheus integration make failure modes visible.
Find the right page¶
| You need to… | Start here |
|---|---|
| Install a released chart | Installation |
| Create your first Garage cluster and bucket | Quickstart |
| Decide between storage, unified, edge, manual, or management-handle shapes | Choose a topology |
| Understand which resource owns a Garage identity | Storage identity and layout |
| Add buckets, keys, aliases, or tokens | Buckets and credentials |
| Operate node-local disks | Node-local pools |
| Remove or replace storage safely | Maintenance and recovery |
| Look up a field, annotation, condition, or value | Reference |
Support boundary¶
The current release line is v0.7.x. The operator requires Garage v2.0.0 or newer and uses Garage's /v2 Admin API. The built-in Garage image is the digest-pinned, CI-tested v2.3.0 image; see the compatibility matrix before selecting a different image.
Kubernetes 1.25+ is supported for ordinary cluster shapes. Node-local pools require Kubernetes 1.27+, a cluster-scoped operator installation, enabled admission/conversion webhooks, leader election, and a workload namespace that permits the required HostPath policy.
The documentation describes the current API contract
Do not infer that every field accepted by an older CRD is active. Some fields are retained for conversion compatibility and are rejected or warned on by admission. The custom-resource reference calls out supported and compatibility-only fields, while the generated schemas remain the validation source of truth.