API Reference#
Packages#
- tenantoperator.stakater.com/v1alpha1
- tenantoperator.stakater.com/v1beta1
- tenantoperator.stakater.com/v1beta3
tenantoperator.stakater.com/v1alpha1#
Package v1alpha1 contains API Schema definitions for the tenantoperator v1alpha1 API group
Resource Types#
AppProjectConfig#
AppProject contains details about argocd AppProjects
Appears in: - ArgoCDConfig
| Field | Description | Default | Validation |
|---|---|---|---|
sourceRepos string array |
SourceRepos contains list of repository URLs which can be used for deployment | ||
namespaceResourceBlacklist GroupKind array |
NamespaceResourceBlacklist contains list of blacklisted namespace level resources | ||
clusterResourceWhitelist GroupKind array |
ClusterResourceWhitelist contains list of whitelisted cluster level resources |
ArgoCD#
Appears in: - IntegrationConfigSpec
| Field | Description | Default | Validation |
|---|---|---|---|
namespace Namespace |
Namespace should contain the name of the namespace in which to deploy ArgoCD AppProjects | Required: {} |
|
namespaceResourceBlacklist GroupKind array |
NamespaceResourceBlacklist contains list of blacklisted namespace level resources | ||
clusterResourceWhitelist GroupKind array |
ClusterResourceWhitelist contains list of whitelisted cluster level resources |
ArgoCDConfig#
ArgoCDConfig contains details about source repositories and AppProjects
Appears in: - ExtensionsSpec
| Field | Description | Default | Validation |
|---|---|---|---|
appProject AppProjectConfig |
AppProject contains details about argocd AppProjects | ||
onDeletePurgeAppProject boolean |
OnDeletePurgeAppProject is used to enable or disable the AppProject purge feature | Optional: {} |
ArgoCDConfigStatus#
ArgoCDStatus defines the observed state of the ArgoCD extension
Appears in: - ExtensionsStatus
| Field | Description | Default | Validation |
|---|---|---|---|
appProjectState boolean |
|||
argoNamespace string |
|||
conditions Condition array |
Endpoint#
Endpoint is used to connect to an application
Appears in: - ManagedApp
| Field | Description | Default | Validation |
|---|---|---|---|
url string |
|||
secretReference SecretReference |
Extensions#
Extensions is the Schema for the extensions API
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string |
tenantoperator.stakater.com/v1alpha1 |
||
kind string |
Extensions |
||
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec ExtensionsSpec |
|||
status ExtensionsStatus |
ExtensionsSpec#
ExtensionsSpec defines the desired state of Extensions
Appears in: - Extensions
| Field | Description | Default | Validation |
|---|---|---|---|
tenantName string |
TenantName is the name of the tenant to which the extension belongs | Required: {} |
|
argoCD ArgoCDConfig |
ArgoCDConfig defines ArgoCD configurations for the tenant |
ExtensionsStatus#
ExtensionsStatus defines the observed state of Extensions
Appears in: - Extensions
| Field | Description | Default | Validation |
|---|---|---|---|
argocd ArgoCDConfigStatus |
Ingress#
Appears in: - IngressConfig
| Field | Description | Default | Validation |
|---|---|---|---|
host string |
Host specifies the hostname for the ingress | ||
tlsSecretName string |
TLSSecretName is the name of the secret containing the TLS certificate | Optional: {} |
IngressConfig#
Appears in: - Provision
| Field | Description | Default | Validation |
|---|---|---|---|
keycloak Ingress |
|||
console Ingress |
|||
gateway Ingress |
|||
ingressClassName string |
ingressClassName is the ingress class name | Optional: {} |
IntegrationConfig#
IntegrationConfig is the Schema for the integrationConfigs API
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string |
tenantoperator.stakater.com/v1alpha1 |
||
kind string |
IntegrationConfig |
||
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec IntegrationConfigSpec |
|||
status IntegrationConfigStatus |
IntegrationConfigSpec#
IntegrationConfigSpec defines the desired state of IntegrationConfig
Appears in: - IntegrationConfig
| Field | Description | Default | Validation |
|---|---|---|---|
openshift OpenshiftConfig |
Openshift is the config containing labels and annotations | ||
tenantRoles TenantRoles |
TenantRoles sets the default Owner/Editor/Viewer and/or custom roles for each tenant | { default:map[editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]]] } | |
nexus ManagedNexus |
Nexus is the config for managed Nexus. | ||
rhsso ManagedRHSSO |
Nexus is the config for managed RHSSO. | ||
vault ManagedVault |
Nexus is the config for managed Vault. | ||
argocd ArgoCD |
ArgoCD contains details about argocd Applications and AppProjects | ||
provision Provision |
Provision is used to enable/disable the provision feature such as mto-console and showback | { console:true showback:true } |
IntegrationConfigStatus#
IntegrationConfigStatus defines the observed state of IntegrationConfig
Appears in: - IntegrationConfig
| Field | Description | Default | Validation |
|---|---|---|---|
roleBindingsToDelete object (keys:string, values:string array) |
RoleBindingsToDelete contains all of the rolebindings that have been whenever the roles cache config map gets updated |
ManagedApp#
ManagedApp is the config for a managed application.
Appears in: - ManagedNexus - ManagedRHSSO
| Field | Description | Default | Validation |
|---|---|---|---|
enabled boolean |
false | ||
endpoint Endpoint |
|||
sso SSO |
ManagedNexus#
ManagedNexus is the config for Nexus.
Appears in: - IntegrationConfigSpec
| Field | Description | Default | Validation |
|---|---|---|---|
ManagedApp ManagedApp |
ManagedRHSSO#
ManagedRHSSO is the config for RedHat Single Sign-On.
Appears in: - IntegrationConfigSpec
| Field | Description | Default | Validation |
|---|---|---|---|
ManagedApp ManagedApp |
|||
realm string |
ManagedVault#
ManagedVault is the config for Vault.
Appears in: - IntegrationConfigSpec
| Field | Description | Default | Validation |
|---|---|---|---|
enabled boolean |
false | ||
address string |
|||
accessorPath string |
|||
roleName string |
|||
sso VaultSSO |
MatchNamespaceLabel#
Appears in: - TenantRoles
| Field | Description | Default | Validation |
|---|---|---|---|
labelSelector LabelSelector |
LabelSelector is the label selector that will be used to find namespaces to apply roles to | ||
UserRoles UserRoles |
Custom roles applied to the namespaces selected by the label selector | Required: {} |
Metadata#
Appears in: - OpenshiftConfig
| Field | Description | Default | Validation |
|---|---|---|---|
labels object (keys:string, values:string) |
|||
annotations object (keys:string, values:string) |
NamespaceAccessPolicy#
NamespaceAccessPolicy contains access and deny policies for namespaces
Appears in: - OpenshiftConfig
| Field | Description | Default | Validation |
|---|---|---|---|
deny Policy |
OpenshiftConfig#
OpenshiftConfig is the config containing labels and annotations
Appears in: - IntegrationConfigSpec
| Field | Description | Default | Validation |
|---|---|---|---|
project Metadata |
Project contains labels and annotations applied to the namespace | ||
group Metadata |
Group contains labels and annotations applied to the group | ||
sandbox Metadata |
Sandbox contains labels and annotations applied to the sandbox | ||
privilegedNamespaces string array |
PrivilegedNamespaces contains list of privileged namespaces regex | ||
privilegedServiceAccounts string array |
PrivilegedServiceAccounts contains list of privileged serviceAccounts regex | ||
namespaceAccessPolicy NamespaceAccessPolicy |
NamespaceAccessPolicy contains groups/users which are denied access over managed namespaces | ||
clusterAdminGroups string array |
ClusterAdminGroups contains groups which are admins of tenants |
Policy#
Policy contains policies relating to privilegedNamespaces
Appears in: - NamespaceAccessPolicy
| Field | Description | Default | Validation |
|---|---|---|---|
privilegedNamespaces PrivilegedNamespaces |
PolicyMembers#
Appears in: - PrivilegedNamespaces
| Field | Description | Default | Validation |
|---|---|---|---|
users string array |
|||
groups string array |
PrivilegedNamespaces#
PrivilegedNamespaces contains groups/users
Appears in: - Policy
| Field | Description | Default | Validation |
|---|---|---|---|
users string array |
|||
groups string array |
Provision#
Appears in: - IntegrationConfigSpec
| Field | Description | Default | Validation |
|---|---|---|---|
console boolean |
Console is used to enable/disable the mto-console | true | Optional: {} |
showback boolean |
Showback is used to enable/disable the showback feature | true | Optional: {} |
ingress IngressConfig |
the following are used to configure the ingress for the provisioned services | ||
trustedRootCert string |
TrustedRootCert is the name of the secret containing the trusted root CA certificate This certificate is used for SSL/TLS communication with other services |
Optional: {} |
SSO#
SSO contains details for single sign on
Appears in: - ManagedApp
| Field | Description | Default | Validation |
|---|---|---|---|
clientName string |
|||
accessorID string |
SecretReference#
SecretReference contains details of a secret
Appears in: - Endpoint
| Field | Description | Default | Validation |
|---|---|---|---|
name string |
|||
namespace string |
TenantRoles#
TenantRoles is used to configure custom RBAC rules for tenants
Appears in: - IntegrationConfigSpec
| Field | Description | Default | Validation |
|---|---|---|---|
default UserRoles |
DefaultRoles contains the default roles that will be applied to each tenant. Required field. | { editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]] } | |
custom MatchNamespaceLabel array |
CustomRoles is an optional Label selector method to apply roles to specific namespaces. These roles will override the existing Default Roles |
UserRoles#
UserRoles is the list of roles applied to owners/editors/viewers
Appears in: - MatchNamespaceLabel - TenantRoles
VaultSSO#
Appears in: - ManagedVault
| Field | Description | Default | Validation |
|---|---|---|---|
clientName string |
tenantoperator.stakater.com/v1beta1#
Package v1beta1 contains API Schema definitions for the tenantoperator v1beta1 API group
Resource Types#
AccessControl#
AccessControl defines the access control settings for IntegrationConfig
Appears in: - IntegrationConfigSpec
| Field | Description | Default | Validation |
|---|---|---|---|
rbac RBAC |
{ tenantRoles:map[default:map[editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]]]] } | ||
namespaceAccessPolicy NamespaceAccessPolicy |
|||
privileged Privileged |
ArgoCDIntegration#
ArgoCD defines the ArgoCD integration settings
Appears in: - Integrations
| Field | Description | Default | Validation |
|---|---|---|---|
clusterResourceWhitelist GroupKind array |
ClusterResourceWhitelist contains list of whitelisted cluster level resources | ||
namespaceResourceBlacklist GroupKind array |
NamespaceResourceWhitelist contains list of whitelisted namespace level resources | ||
namespace Namespace |
Namespace should contain the name of the namespace in which to deploy ArgoCD AppProjects | Required: {} |
Components#
Components defines the components settings for IntegrationConfig
Appears in: - IntegrationConfigSpec
| Field | Description | Default | Validation |
|---|---|---|---|
console boolean |
false | ||
showback boolean |
false | ||
showbackOpts ShowbackOpts |
ShowbackOpts is used to configure the showback for the Component ShowbackOpts is deprecated and will be removed in a future release. See docs.stakater.com/mto/latest for more details on the replacement for showback configuration. |
||
ingress IngressConfig |
the following are used to configure the ingress for the Component's services | ||
prometheus PrometheusComponentConfig |
Defines configuration for prometheus component | Optional: {} |
|
opencost OpenCostComponentConfig |
Defines configuration for opencost component | Optional: {} |
|
postgres PostgresComponentConfig |
Defines configuration for postgres component | Optional: {} |
|
dex DexComponentConfig |
Defines configuration for dex component | Optional: {} |
|
finopsOperator FinOpsOperator |
Defines configuration for finops operator component | Optional: {} |
|
dexConfigOperator DexConfigOperatorConfig |
Defines configuration for dex config operator component | Optional: {} |
Custom#
Appears in: - ShowbackOpts
| Field | Description | Default | Validation |
|---|---|---|---|
CPU string |
|||
spotCPU string |
|||
RAM string |
|||
spotRAM string |
|||
GPU string |
|||
storage string |
|||
zoneNetworkEgress string |
|||
regionNetworkEgress string |
|||
internetNetworkEgress string |
|||
provider string |
|||
description string |
|||
projectId string |
|||
awsSpotDataBucket string |
|||
awsSpotDataRegion string |
|||
awsSpotDataPrefix string |
|||
spotLabel string |
|||
spotLabelValue string |
Deny#
Deny defines the deny settings for namespace access policy
Appears in: - NamespaceAccessPolicy
| Field | Description | Default | Validation |
|---|---|---|---|
privilegedNamespaces PrivilegedNamespaces |
DependencyMode#
Underlying type: string
DependencyMode describes how a dependency is provided
Validation: - Enum: [Managed External]
Appears in: - DexComponentConfig - OpenCostComponentConfig - PostgresComponentConfig - PrometheusComponentConfig
| Field | Description |
|---|---|
Managed |
DependencyModeManaged indicates the operator should provision and manage the dependency |
External |
DependencyModeExternal indicates the dependency is supplied by the user |
DexComponentConfig#
Appears in: - Components
| Field | Description | Default | Validation |
|---|---|---|---|
mode DependencyMode |
Managed | Enum: [Managed External] |
|
values RawExtension |
Values allows customization of the Prometheus Helm chart values when mode is Managed | ||
external DexExternalConfig |
External defines information required when using an externally managed Dex deployment |
DexConfigOperatorConfig#
Appears in: - Components
| Field | Description | Default | Validation |
|---|---|---|---|
values RawExtension |
Values allows customization of the Prometheus Helm chart values |
DexExternalConfig#
Appears in: - DexComponentConfig
| Field | Description | Default | Validation |
|---|---|---|---|
issuer string |
Issuer is the URL of the Dex issuer, used for OIDC discovery |
ExternalServerConfig#
ExternalServerConfig stores references to an external Prometheus deployment
Appears in: - OpenCostComponentConfig - PrometheusComponentConfig
| Field | Description | Default | Validation |
|---|---|---|---|
serverURL string |
ServerURL is the base URL that the operator should use for query API access |
FinOpsOperator#
FinOpsOperator defines the configuration for FinOps Operator components See https://docs.stakater.com/finops-operator/latest for more details
Appears in: - Components
| Field | Description | Default | Validation |
|---|---|---|---|
values RawExtension |
Values allows customization of the FinOps Operator Helm chart values when mode is Managed | Optional: {} |
Ingress#
Appears in: - IngressConfig
| Field | Description | Default | Validation |
|---|---|---|---|
host string |
Host specifies the hostname for the ingress (legacy per-component mode). | ||
tlsSecretName string |
TLSSecretName is the name of the secret containing the TLS certificate. | Optional: {} |
|
path string |
Path is the path prefix under the shared host in consolidated mode. Defaults: Console "/", Gateway "/gateway", Dex "/dex", FinOps "/finops". |
Optional: {} |
IngressConfig#
Appears in: - Components
| Field | Description | Default | Validation |
|---|---|---|---|
host string |
Host, when set, enables consolidated mode: all components are served under this single shared hostname via distinct path prefixes. When empty, the per-component Console/Gateway/Dex/FinOpsGateway hosts are used (legacy). |
Optional: {} |
|
tlsSecretName string |
TLSSecretName is the TLS secret for the shared host (consolidated mode). | Optional: {} |
|
console Ingress |
|||
gateway Ingress |
|||
dex Ingress |
|||
finopsGateway Ingress |
|||
ingressClassName string |
ingressClassName is the ingress class name | Optional: {} |
IntegrationConfig#
IntegrationConfig is the Schema for the integrationconfigs API
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string |
tenantoperator.stakater.com/v1beta1 |
||
kind string |
IntegrationConfig |
||
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec IntegrationConfigSpec |
|||
status IntegrationConfigStatus |
IntegrationConfigSpec#
IntegrationConfigSpec defines the desired state of IntegrationConfig
Appears in: - IntegrationConfig
| Field | Description | Default | Validation |
|---|---|---|---|
accessControl AccessControl |
{ rbac:map[tenantRoles:map[default:map[editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]]]]] } | ||
components Components |
|||
metadata Metadata |
Refer to Kubernetes API documentation for fields of metadata. |
||
integrations Integrations |
|||
tenantPolicies TenantPolicies |
IntegrationConfigStatus#
IntegrationConfigStatus defines the observed state of IntegrationConfig
Appears in: - IntegrationConfig
| Field | Description | Default | Validation |
|---|---|---|---|
roleBindingsToDelete object (keys:string, values:string array) |
|||
conditions Condition array |
Status conditions |
Integrations#
Integrations defines the integration settings for IntegrationConfig
Appears in: - IntegrationConfigSpec
| Field | Description | Default | Validation |
|---|---|---|---|
argocd ArgoCDIntegration |
|||
vault VaultIntegration |
MatchNamespaceLabel#
Appears in: - TenantRoles
| Field | Description | Default | Validation |
|---|---|---|---|
labelSelector LabelSelector |
LabelSelector is the label selector that will be used to find namespaces to apply roles to | ||
UserRoles UserRoles |
Custom roles applied to the namespaces selected by the label selector |
Metadata#
Metadata defines the metadata settings for IntegrationConfig
Appears in: - IntegrationConfigSpec
| Field | Description | Default | Validation |
|---|---|---|---|
groups MetadataType |
Groups contains labels and annotations applied to the groups | ||
namespaces MetadataType |
Namespaces contains labels and annotations applied to the namespaces | ||
sandboxes MetadataType |
Sandboxes contains labels and annotations applied to the sandbox |
MetadataType#
Appears in: - Metadata
| Field | Description | Default | Validation |
|---|---|---|---|
labels object (keys:string, values:string) |
|||
annotations object (keys:string, values:string) |
NamespaceAccessPolicy#
NamespaceAccessPolicy defines the namespace access policy settings
Appears in: - AccessControl
| Field | Description | Default | Validation |
|---|---|---|---|
deny Deny |
OpenCostComponentConfig#
OpenCostComponentConfig describes how OpenCost is configured for showback features
Appears in: - Components
| Field | Description | Default | Validation |
|---|---|---|---|
mode DependencyMode |
Managed | Enum: [Managed External] |
|
values RawExtension |
Values allows customization of the OpenCost Helm chart values when mode is Managed | ||
external ExternalServerConfig |
External defines information required when using an externally managed OpenCost deployment |
PolicyRule#
PolicyRule defines the policy rule
Appears in: - VaultPolicy
| Field | Description | Default | Validation |
|---|---|---|---|
path string |
Path is the path to the resource | ||
capabilities string array |
Capabilities is the list of capabilities |
PostgresComponentConfig#
PostgresComponentConfig describes how Postgres is configured for application persistence
Appears in: - Components
| Field | Description | Default | Validation |
|---|---|---|---|
mode DependencyMode |
Managed | Enum: [Managed External] |
|
values RawExtension |
Values allows customization of the Postgres Helm chart values when mode is Managed | ||
external PostgresExternalConfig |
External defines information required when using an externally managed Postgres instance |
PostgresExternalConfig#
PostgresExternalConfig stores references to an external Postgres instance
Appears in: - PostgresComponentConfig
| Field | Description | Default | Validation |
|---|---|---|---|
secretRef SecretRef |
SecretRef references a secret containing a DSN or discrete connection details |
Privileged#
Privileged defines the privileged settings for IntegrationConfig
Appears in: - AccessControl
| Field | Description | Default | Validation |
|---|---|---|---|
namespaces string array |
|||
serviceAccounts string array |
|||
users string array |
|||
groups string array |
PrivilegedNamespaces#
PrivilegedNamespaces defines the list of privileged namespaces and associated users/groups
Appears in: - Deny
| Field | Description | Default | Validation |
|---|---|---|---|
users string array |
|||
groups string array |
PrometheusComponentConfig#
PrometheusComponentConfig describes how Prometheus is configured for tenant operations
Appears in: - Components
| Field | Description | Default | Validation |
|---|---|---|---|
mode DependencyMode |
Managed | Enum: [Managed External] |
|
values RawExtension |
Values allows customization of the Prometheus Helm chart values when mode is Managed | ||
external ExternalServerConfig |
External defines information required when using an externally managed Prometheus |
Quota#
Quota is the Schema for the quotas API
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string |
tenantoperator.stakater.com/v1beta1 |
||
kind string |
Quota |
||
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec QuotaSpec |
|||
status QuotaStatus |
QuotaSpec#
Appears in: - Quota
| Field | Description | Default | Validation |
|---|---|---|---|
resourcequota ResourceQuotaSpec |
ResourceQuota defines the allocated ResourceQuota for the tenant | ||
limitrange LimitRangeSpec |
LimitRange defines the allocated LimitRange for the namespace inside tenant | Optional: {} |
QuotaStatus#
QuotaStatus defines the observed state of Quota
Appears in: - Quota
| Field | Description | Default | Validation |
|---|---|---|---|
TenantQuotaStatus TenantQuotaStatus |
|||
conditions Condition array |
Status conditions for quota |
RBAC#
RBAC defines the RBAC settings for IntegrationConfig
Appears in: - AccessControl
| Field | Description | Default | Validation |
|---|---|---|---|
tenantRoles TenantRoles |
TenantRoles sets the default Owner/Editor/Viewer and/or custom roles for each tenant | { default:map[editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]]] } |
SecretRef#
SecretReference defines the reference to a secret
Appears in: - PostgresExternalConfig - ShowbackOpts - VaultAccessInfo
| Field | Description | Default | Validation |
|---|---|---|---|
name string |
|||
namespace string |
ShowbackOpts#
Appears in: - Components
| Field | Description | Default | Validation |
|---|---|---|---|
custom Custom |
Custom is used to define custom pricing for opencost. If not provided, the default pricing will be used. Custom field is deprecated and will be removed in a future release. Please use the spec.components.finopsOperator.priceBook field instead to configure custom pricing for OpenCost. |
Optional: {} |
|
cloudPricingSecretRef SecretRef |
CloudPricingSecretRef is the reference to the secret containing the opeconst config for AWS/Azure. This field is deprecated and will be removed in a future release. Please use the spec.components.opencost.cloudIntegrationSecret field instead to configure the cloud integration for OpenCost. |
Optional: {} |
|
retentionPeriod string |
RetentionPeriod defines the retention period of prometheus server This field is deprecated and will be removed in a future release. Please use the spec.components.prometheus.retention field instead to configure the retention period for Prometheus. |
7d |
TenantPolicies#
Appears in: - IntegrationConfigSpec
| Field | Description | Default | Validation |
|---|---|---|---|
network TenantPoliciesNetwork |
TenantPoliciesNetwork#
Appears in: - TenantPolicies
| Field | Description | Default | Validation |
|---|---|---|---|
disableIntraTenantNetworking boolean |
|||
disableNodePortServices boolean |
|||
disableHostPorts boolean |
TenantQuotaStatus#
Appears in: - QuotaStatus
| Field | Description | Default | Validation |
|---|---|---|---|
tenants object (keys:string, values:TenantResourceStatus) |
TenantResourceStatus#
Appears in: - TenantQuotaStatus
| Field | Description | Default | Validation |
|---|---|---|---|
status ResourceQuotaStatus |
TenantRoles#
Appears in: - RBAC
| Field | Description | Default | Validation |
|---|---|---|---|
default UserRoles |
DefaultRoles contains the default roles that will be applied to each tenant. Required field. | { editor:map[clusterRoles:[edit]] owner:map[clusterRoles:[admin]] viewer:map[clusterRoles:[view]] } | |
custom MatchNamespaceLabel array |
CustomRoles is an optional Label selector method to apply roles to specific namespaces. These roles will override the existing Default Roles |
UserRoles#
Appears in: - MatchNamespaceLabel - TenantRoles
VaultAccessInfo#
VaultAccessInfo defines the access information for Vault
Appears in: - VaultIntegration
| Field | Description | Default | Validation |
|---|---|---|---|
accessorPath string |
|||
address string |
|||
roleName string |
|||
secretRef SecretRef |
VaultConfig#
VaultConfig defines the Vault configuration
Appears in: - VaultIntegration
| Field | Description | Default | Validation |
|---|---|---|---|
ssoClient string |
|||
commonSecretsPath string |
CommonSecretsPath defines a secrets path in Vault which is shared by all tenants | Optional: {} |
VaultIntegration#
Vault defines the Vault integration settings
Appears in: - Integrations
| Field | Description | Default | Validation |
|---|---|---|---|
enabled boolean |
false | ||
authMethod string |
AuthMethod defines the authentication method for Vault, Possible values are: "kubernetes", "token" | kubernetes | Enum: [kubernetes token] |
accessInfo VaultAccessInfo |
AccessInfo defines the access information for Vault | ||
config VaultConfig |
Config defines the Vault configuration | ||
policies VaultPolicy array |
Policies defines custom Vault policies | Optional: {} |
VaultPolicy#
VaultPolicy defines the Vault policy details
Appears in: - VaultIntegration
| Field | Description | Default | Validation |
|---|---|---|---|
name string |
Name is the name of the policy | ||
rules PolicyRule array |
Rules is the policy rules | ||
tenantRoles string array |
TenantRoles is the list of tenant roles to apply the policy to |
tenantoperator.stakater.com/v1beta3#
Package v1beta3 contains API Schema definitions for the tenantoperator v1beta3 API group
Resource Types#
AccessControl#
Appears in: - TenantSpec
| Field | Description | Default | Validation |
|---|---|---|---|
owners Members |
owners represents the list of owners | ||
editors Members |
editors represents the list of editors | ||
viewers Members |
viewers represents the list of viewers |
HostValidationConfig#
Appears in: - TenantSpec
| Field | Description | Default | Validation |
|---|---|---|---|
denyWildcards boolean |
DenyWildcards indicates whether wildcard host names are allowed or not If true, wildcard host names are not allowed If false, wildcard host names are allowed |
false | Optional: {} Type: boolean |
allowedRegex string |
AllowedRegex is a regular expression that defines the allowed host names If specified, host names must match this regex to be allowed |
Optional: {} Type: string |
|
allowed string array |
Allowed is a list of allowed host names If specified, host names must be in this list to be allowed |
Optional: {} Type: array |
IngressClassEntry#
Appears in: - IngressClassStatus
| Field | Description | Default | Validation |
|---|---|---|---|
name string |
IngressClassStatus#
Appears in: - TenantStatus
| Field | Description | Default | Validation |
|---|---|---|---|
available IngressClassEntry array |
Metadata#
Appears in: - Namespaces
| Field | Description | Default | Validation |
|---|---|---|---|
common Metadata |
commonmetadata applies given labels and annotations | ||
sandbox Metadata |
sandboxmetadata applies given labels and annotation across sandbox namespaces | ||
specific MetadataOnNamespaces array |
specificmetadata applies given labels and annotation across specific namespaces |
Namespaces#
Appears in: - TenantSpec
| Field | Description | Default | Validation |
|---|---|---|---|
sandboxes Sandboxes |
sandboxes is used to enable or disable the sandbox feature | ||
withoutTenantPrefix Namespace array |
WithoutTenantPrefix will create new namespaces mentioned in it | ||
withTenantPrefix Namespace array |
WithTenantPrefix will create new namespaces mentioned in it and add a prefix of the tenant name to them | ||
onDeletePurgeNamespaces boolean |
ondeletepurgenamespaces is used to enable or disable the namespace purge feature | false | |
metadata Metadata |
Refer to Kubernetes API documentation for fields of metadata. |
NamespacesStatus#
Appears in: - TenantStatus
| Field | Description | Default | Validation |
|---|---|---|---|
commonStatus Metadata |
CommonStatus stores the previous state of labels and annotation applied across all tenant namespaces, if mentioned in spec | ||
sandboxStatus Metadata |
SandboxStatus stores the previous state of labels and annotation applied across all sandbox namespaces, if mentioned in spec | ||
specificStatus MetadataOnNamespaces array |
SpecificStatus stores the previous state of labels and annotations applied across specific tenant namespaces, if mentioned in spec |
PodPriorityClassEntry#
Appears in: - PodPriorityClassStatus
| Field | Description | Default | Validation |
|---|---|---|---|
name string |
PodPriorityClassStatus#
Appears in: - TenantStatus
| Field | Description | Default | Validation |
|---|---|---|---|
available PodPriorityClassEntry array |
QuotaEntry#
Appears in: - QuotaStatus
| Field | Description | Default | Validation |
|---|---|---|---|
name string |
QuotaStatus#
Appears in: - TenantStatus
| Field | Description | Default | Validation |
|---|---|---|---|
available QuotaEntry array |
Sandboxes#
Appears in: - Namespaces
| Field | Description | Default | Validation |
|---|---|---|---|
enabled boolean |
enabled is used to enable or disable the sandbox feature | ||
private boolean |
private is used to enable or disable the private sandbox feature |
StorageClassEntry#
Appears in: - StorageStatus
| Field | Description | Default | Validation |
|---|---|---|---|
name string |
StorageStatus#
Appears in: - TenantStatus
| Field | Description | Default | Validation |
|---|---|---|---|
available StorageClassEntry array |
Tenant#
Tenant is the Schema for the tenants API
| Field | Description | Default | Validation |
|---|---|---|---|
apiVersion string |
tenantoperator.stakater.com/v1beta3 |
||
kind string |
Tenant |
||
metadata ObjectMeta |
Refer to Kubernetes API documentation for fields of metadata. |
||
spec TenantSpec |
|||
status TenantStatus |
TenantSpec#
TenantSpec defines the desired state of Tenant
Appears in: - Tenant
| Field | Description | Default | Validation |
|---|---|---|---|
quota string |
Quota field is used to link relevant Tenant Operator Quota CR | Required: {} |
|
accessControl AccessControl |
AccessControl defines the list of admins, editors and viewers | ||
namespaces Namespaces |
namespaces defines namespaces and their metadata | ||
desc string |
Desc can contains description about the tenant | ||
hostValidationConfig HostValidationConfig |
HostValidationConfig defines the allowed ingress and route host names for the tenant | Optional: {} |
TenantStatus#
TenantStatus defines the observed state of Tenant
Appears in: - Tenant
| Field | Description | Default | Validation |
|---|---|---|---|
namespaces NamespacesStatus |
namespacesStatus stores the previous state of namespaces, if mentioned in spec | ||
sandboxState boolean |
SandboxState stores the previous state of sandbox field, if mentioned in spec | ||
deployedSandboxes object (keys:string, values:string) |
DeployedSandboxes has the map for created sandbox environments so they can be synced with spec | ||
deployedNamespaces string array |
DeployedNamespaces has the string for created namespaces so they can be synced with spec | ||
storageClasses StorageStatus |
StorageClasses is the status for currently available StorageClasses for the tenant | ||
ingressClasses IngressClassStatus |
IngressClasses is the status for currently available IngressClasses for the tenant | ||
podPriorityClasses PodPriorityClassStatus |
PodPriorityClasses is the status for currently available PodPriorityClasses for the tenant | ||
quota QuotaStatus |
Quota is the status for the tenant's Quota | ||
conditions Condition array |
Status conditions for tenant |