---
schema_version: "1"
id: 73b6fb4960f0bf71d67836adfab3c2f10299a46a47d0b1a8604670b8b862dae3
title: Customize Mule App Kubernetes Resources
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-fabric/2.5/customize-kubernetes-crd.md
canonical_url: https://docs.mulesoft.com/runtime-fabric/2.5/customize-kubernetes-crd
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 3e0d86fa6ac08a4335f24af2bf07ddf05090ac1bcca754ebc7e5bd15cf1cb1fe
description: MuleSoft Documentation Site
release: "2.5"
latest: false
---
---
product: Runtime Fabric
version: 2.5
---

# Customize Mule App Kubernetes Resources

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Runtime Fabric enables you to customize your Mule app Kubernetes resources through the
custom resource `kubernetestemplates.rtf.mulesoft.com` template.

Name the `kubernetestemplate` resource as `mule-application`. You can define the template in two
different namespaces:

- Apps namespace  
  The template is applied to all Mule apps deployed to the given namespace.

- Runtime Fabric agent namespace  
  The template is applied to all Mule apps managed by the given Runtime Fabric agent.

The `kubernetestemplate` resource applies only to new Mule app deployments after the resource
creation. It does not affect existing deployments. If you redeploy a Mule app after creating or
updating the `kubernetestemplate`, the template is applied.

The `kubernetestemplate` resource enables you to configure the following elements of your apps pods,
deployments, and services objects:

- Pod

  - [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)

  - [Labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)

  - [Node selectors](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/)

  - [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/)

  - [Security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)

  - [Ephemeral storage limit](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#local-ephemeral-storage)

  - [Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)

  - [Topology spread constraints](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)

For the security context pod, the key to use is `containerSecurityContext`.

- Deployment

  - Annotations

  - Labels

- Service

  - Annotations

  - Labels

Configuration elements already defined by Runtime Fabric take precedence over the ones you define in
the template.

To get the CRD of key elements that you can configure for the template, you can get the Kubernetes
specification by running the following command:

```copy
kubectl get crd kubernetestemplates.rtf.mulesoft.com -o yaml
```

## Examples

Configuring `labels` at `pod`, `deploy`, and `service` objects:

```copy
apiVersion: rtf.mulesoft.com/v1
kind: KubernetesTemplate
metadata:
  name: mule-application
  namespace: rtf
spec:
  deployment:
    metadata:
      labels:
        deploymentLabel: value
  service:
    metadata:
      labels:
        serviceLabel: value
  pod:
    metadata:
      labels:
        podLabel: value
```

Configuring the runtime default `seccompProfile` for `containerSecurityContext` under the `pod`
object:

```copy
apiVersion: rtf.mulesoft.com/v1
kind: KubernetesTemplate
metadata:
  name: mule-application
  namespace: rtf
spec:
  pod:
    containerSecurityContext:
      seccompProfile:
        type: RuntimeDefault
```

Another example with all the keys that you can configure:

```copy
apiVersion: "rtf.mulesoft.com/v1"
kind: KubernetesTemplate
metadata:
  name: mule-application
  namespace: rtf
  labels:
spec:
  deployment:
    metadata:
      labels:
      annotations:
  service:
    metadata:
      labels:
      annotations:
  pod:
    metadata:
      labels:
      annotations:
    containerSecurityContext:
      seccompProfile:
        type: RuntimeDefault
    tolerations:
    - key: "example-key"
      operator: "Exists"
      effect: "NoSchedule"
    ephemeralStorageLimit: 4gb
    nodeSelector:
      region: us-east
    affinity:
    topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: topology.kubernetes.io/zone
      whenUnsatisfiable: DoNotSchedule
      labelSelector:
        matchLabels:
          rtf.mulesoft.com/id: {{ .Values.id }}
```

Key elements that can not be overwritten using the CRD:

- Deployment

  - labels

    - environment

    - organization

    - type

    - rtf.mulesoft.com/id

    - rtf.mulesoft.com/version

    - rtf.mulesoft.com/agentNamespace

- annotations

  - rtfc.mulesoft.com/egress-ruleset (if set in deployment values)

  - rtf.mulesoft.com/desiredStatus

  - rtf.mulesoft.com/replicas

  - rtf.mulesoft.com/version

- Pods

  - annotations

    - fluentbit.io/exclude

    - mulesoft.com/resources

  - labels

    - app

    - environment

    - am-org-id

    - root-org-id

    - organization

    - rtf.mulesoft.com/id

    - rtf.mulesoft.com/generation

    - type

    - rtf.mulesoft.com/disableAmLogForwarding

    - name

- Resources

  - ephemeral-storage (if is not set in env.resources or cluster flavor is rtfc)

- SecurityContext

  - runAsUser

  - runAsGroup

  - allowPrivilageEscalation

  - capabilities

  - privileged

  - readOnlyRootFilesystem

- NodeSelector

  - kubernetes.io/os

  - kubernetes.io/arch

  - beta.kubernetes.io/os

  - beta.kubernetes.io/arch

  - RTF.DeploymentNodeSelector

- Affinity

  - podAntiAffinity

- Service

  - labels

    - ingress.rtf.mulesoft.com/bind

    - rtf.mulesoft.com/id

    - rtf.mulesoft.com/version

    - rtf.mulesoft.com/agentNamespace

  - annotations

    - rtf.mulesoft.com/merge-policy

    - rtf.mulesoft.com/environment

    - rtf.mulesoft.com/organization