Configuring a ProcessGroup
The ProcessGroup custom resource imports a flow definition from a ConfigMap or Secret into a target NiFi instance, starts the flow, and records the NiFi process group identifier in status for use by other operator-managed resources.
A ProcessGroup represents a process group on the NiFi canvas. Cloudera Flow Management Operator for Kubernetes creates the process group through an initial import of a JSON
flow definition stored in a Secret or ConfigMap.
A process group is a logical container that groups multiple NiFi components so you can reason about a data flow at a higher level. Process groups support parameter contexts for externally managed configuration and can be versioned through NiFi Registry for flow change tracking.
Reconciliation behavior
Cloudera Flow Management Operator for Kubernetes imports the flow definition into NiFi and starts all components when the resource is first created.
On every subsequent reconcile, the operator checks whether the process group still exists in NiFi:
- Found and healthy — the operator requeues to continue periodic drift checks.
- Found with an error condition — the operator retries the failed step (for example, starts a group that was imported but never successfully started).
- Deleted from the NiFi UI — the operator detects the drift, re-imports and restarts the process group, and assigns a new NiFi identifier.
The operator does not reconcile individual processors, connections, or other components inside the process group. Canvas edits made directly in the NiFi UI are preserved, except when the entire process group is deleted from the UI (see above).
The referenced ConfigMap or Secret is not continuously watched. Updating it while the process
group exists in NiFi has no immediate effect. The new content is used on the next import,
either when the process group is deleted from the NiFi UI (triggering automatic re-import) or
when the ProcessGroup custom resource is deleted and recreated.
When you delete the ProcessGroup custom resource, the operator stops the
process group, empties all connection queues, and removes it from the NiFi instance before the
resource is fully deleted.
Example
apiVersion: cfm.cloudera.com/v1
kind: ProcessGroup
metadata:
name: [***PROCESS GROUP NAME***]
spec:
nifiRef:
namespace: [***NIFI CLUSTER NAMESPACE***]
name: [***NIFI CLUSTER NAME***]
flowDefinition:
configMapRef:
name: [***CONFIGMAP NAME***]
key: [***KEY WITHIN THE CONFIGMAP THAT HOLDS THE FLOW JSON***]Target NiFi
A process group must reference the NiFi instance where it will be created.
| Field | Type | Required | Description |
|---|---|---|---|
nifiRef |
NifiRef |
Yes | Reference to the target NiFi instance |
Flow definition
You can initialize a process group from a raw flow definition in a ConfigMap or Secret when
the flow is not managed in a registry. Specify only one of configMapRef or
secretRef under flowDefinition.
| Field | Type | Required | Description |
|---|---|---|---|
configMapRef |
ConfigMapReference |
No | Reference to a ConfigMap that contains the flow definition |
secretRef |
SecretReference |
No | Reference to a Secret that contains the flow definition |
ConfigMap reference
| Field | Type | Required | Description |
|---|---|---|---|
name |
string |
Yes | Name of the ConfigMap that contains the flow definition |
key |
string |
Yes | Key within the ConfigMap that holds the flow JSON |
namespace |
string |
No | Namespace of the ConfigMap; defaults to the ProcessGroup namespace |
Secret reference
| Field | Type | Required | Description |
|---|---|---|---|
name |
string |
Yes | Name of the Secret that contains the flow definition |
key |
string |
Yes | Key within the Secret that holds the flow JSON |
namespace |
string |
No | Namespace of the Secret; defaults to the ProcessGroup namespace |
Status
After reconciliation, the operator writes the NiFi process group identifier to
status.identifier. Other custom resources (for example, User,
UserGroup, or AccessPolicyProfile) can reference this process
group by name through spec.accessPolicies[].resourceRefs with
kind: ProcessGroup. The operator resolves the reference to
/process-groups/<identifier> at reconcile time.
The ProcessGroup must target the same Nifi instance as the
User or UserGroup that references it. If
nifiRef points at another instance, the consumer reports
ProcessGroupTargetsDifferentNiFi on the CompleteAccessPolicies
condition. For more information, see Configuring a user identity with access policies.
status:
identifier: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
conditions:
- type: "Ready"
status: "True"
reason: "Deployed"
message: "Process group deployed with ID a1b2c3d4-e5f6-7890-abcd-ef1234567890"
lastTransitionTime: "2026-01-15T10:30:00Z"
observedGeneration: 1