Custom resource definitions
The custom resource definitions of the gentianos.io API group, with every field of their spec and status. Paths are dotted from the object root; [] marks the items of a list and {} the values of a map. apiVersion, kind and metadata are the standard object fields and are not listed.
| Kind | Scope | Description |
|---|---|---|
| App | Namespaced | |
| AppGrant | Namespaced | AppGrant is a tenant-scoped authorization grant — a subset of what the ComponentProfile declares. |
| AppPackage | Cluster | AppPackage is a named addon preset for a family. |
| BackupPolicy | Cluster | BackupPolicy is where a tenant's bundles go and who can read them. |
| Branding | Cluster | Branding is the brand every page on the cluster shows: the concierge, the identity provider's screens, the desktop and the consoles. |
| BundleSource | Cluster | BundleSource is a place outside the cluster that holds bundles: the cluster's, declared by its administrator and read to make a tenant; or a tenant's own… |
| Component | Namespaced | Component is an installed instance of a ComponentProfile. |
| ComponentProfile | Cluster | ComponentProfile is a catalog entry for a system service, an app or an agent. |
| CredentialRequirement | Cluster | CredentialRequirement declares a secret that must be supplied from outside the cluster: a registry token, a DNS provider key, an SMTP relay password. |
| Customization | Namespaced | Customization is a tracked, owned, dated deviation from an app as shipped. |
| IntegrationBinding | Namespaced | IntegrationBinding is the Schema for the integrationbindings API. |
| MailboxRemoval | Cluster | MailboxRemoval records what whoever removed a person decided about that person's mailbox, and what became of it. |
| OIDCPackCatalog | Cluster | OIDCPackCatalog is a cluster-scoped catalog of OIDC packs for tenant apps. |
| PlanOrdering | Cluster | PlanOrdering is the cluster's notice on how to order another plan. |
| PlatformSecurityPolicy | Cluster | PlatformSecurityPolicy is the cluster singleton where platform administrators approve MAC waivers and other cluster-wide security posture settings. |
| ProfileBuild | Cluster | ProfileBuild is one build of a profile, as a catalog published it: the bundle at one digest, kept on the cluster for as long as a tenant runs it. |
| ResourcePlan | Cluster | ResourcePlan is a named preset of tenant resource limits. |
| Tenant | Cluster | Tenant is the Schema for the tenants API. |
| TenantDomain | Cluster | TenantDomain moves the tenant it is named after to spec.domain. |
| TenantExport | Namespaced | TenantExport captures one tenant's data into an encrypted bundle. |
| TenantRestore | Namespaced | TenantRestore restores a tenant's data from a bundle. |
| XTenant | Cluster |
1. App
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Namespaced |
| Plural | apps |
| Short names |
| Field | Type | Required | Description |
|---|---|---|---|
spec | object (free-form) | ||
status | object (free-form) |
2. AppGrant
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Namespaced |
| Plural | appgrants |
| Short names | ag, grant |
AppGrant is a tenant-scoped authorization grant — a subset of what the ComponentProfile declares.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | AppGrantSpec defines tenant-approved integration permissions for one installed app. | |
spec.allowConsumers | []object | AllowConsumers controls which other installed apps may invoke this app's provides contracts. | |
spec.allowConsumers[].app | string | yes | App is the consumer ComponentProfile name. |
spec.allowConsumers[].contract | string | yes | Contract matches ComponentProfile.spec.provides[].name. |
spec.allowConsumers[].scope | []string | yes | Scope lists approved capability strings for the consumer. |
spec.app | string | yes | App is the installed ComponentProfile name (matches Tenant.spec.apps[].profile). |
spec.consume | []object | Consume lists contract capabilities this app may use from providers in the tenant. | |
spec.consume[].contract | string | yes | Contract matches IntegrationBinding.spec.contract. |
spec.consume[].granted | []string | yes | Granted lists approved capability strings (subset of the binding declaration). |
status | object | AppGrantStatus holds observed grant state. | |
status.conditions | []object | Conditions provide detailed status. | |
status.conditions[].lastTransitionTime | string (date-time) | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer (int64) | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
status.conditions[].status | string | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.observedGeneration | integer (int64) | ObservedGeneration is the last reconciled spec generation. | |
status.phase | string | Phase summarizes OpenFGA tuple sync. |
3. AppPackage
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | apppackages |
| Short names | apkg, apkgs |
AppPackage is a named addon preset for a family. Presentation only — see the type comment above for why it carries no status and no reconciler.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | AppPackageSpec is the desired state of an AppPackage. | |
spec.addons | []string | yes | Addons lists the ComponentProfile names this preset preselects. |
spec.author | string | Author is who supplies this preset — a company, an organization, or an individual. | |
spec.description | string | Description explains what the preset bundles, for the selection window. | |
spec.displayName | string | yes | DisplayName is the name shown in the App Store (e.g. |
spec.family | string | yes | Family is the app family this preset belongs to (a ComponentProfile's gentianos.io/profile-family label). |
spec.tile | object | Tile is the App Store icon for the preset. | |
spec.tile.icon | string | Icon selects a pre-made tile from the Gentian catalog (path 2). | |
spec.tile.image | string | Image is a profile-relative PNG path used in git only (e.g. | |
spec.tile.logo | string | Logo is a custom tile as a PNG data URI (path 1). |
4. BackupPolicy
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | backuppolicies |
| Short names | bkpol |
BackupPolicy is where a tenant's bundles go and who can read them. Cluster-scoped for both scopes, as CredentialRequirement is: the console mediates access by spec.tenant, and the credential itself is governed by the OpenBao policy its scope selects. The name is not free. Every reader of a policy fetches it by name — the cluster's as "default", a tenant's as the tenant's own name — so a policy whose name does not match its scope is never read by anything. That failed silently: the policy reported Accepted, published an effective destination, and bundles went to the platform's own storage as though it had never been written. The two rules below make that object unadmittable rather than merely ineffective.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | BackupPolicySpec is one backup arrangement: the cluster's default, or one tenant's override of it. | |
spec.allowTenantOverride | boolean | AllowTenantOverride lets tenants state policies of their own. | |
spec.destination | object | Destination is where bundles are written. | |
spec.destination.addressingStyle | string | AddressingStyle is how a bucket is named in a request to Endpoint: path (https://host/bucket/key, the default when empty) or virtualHost… | |
spec.destination.bucket | string | Bucket holds the bundles. | |
spec.destination.endpoint | string | Endpoint is the S3 API URL, e.g. https://sos-ch-gva-2.exo.io or https://s3.example.org:9000. | |
spec.destination.region | string | Region, for providers that require one — Exoscale SOS and AWS do, the platform's own store does not. | |
spec.encryption | object | Encryption names the keys bundles are encrypted to. | |
spec.encryption.recipients | []string | Recipients are age public keys (age1…) to encrypt to. | |
spec.scope | string | yes | Scope decides whether this is the cluster default or one tenant's override, and with it who may edit the policy and which OpenBao path its credential lives at. |
spec.tenant | string | Tenant names the tenant a tenant-scoped policy belongs to. | |
status | object | BackupPolicyStatus reports what this policy resolved to and whether it can actually be used. | |
status.conditions | []object | Conditions carries Accepted: whether this policy is permitted and usable. | |
status.conditions[].lastTransitionTime | string (date-time) | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer (int64) | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
status.conditions[].status | string | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.credentialRequirement | string | CredentialRequirement names the requirement carrying this destination's keys, and CredentialSatisfied reports whether it has been filled. | |
status.credentialSatisfied | boolean | ||
status.effectiveBucket | string | ||
status.effectiveEndpoint | string | EffectiveEndpoint and EffectiveBucket are the values in force after inheritance, published so an admin reads what applies rather than recomputing the merge. | |
status.effectiveRecipients | []string | EffectiveRecipients are the age public keys in force, empty when the cluster's own key is used. | |
status.observedGeneration | integer (int64) |
5. Branding
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | brandings |
| Short names |
Branding is the brand every page on the cluster shows: the concierge, the identity provider's screens, the desktop and the consoles. One per cluster, named "default"; without it they show the platform's own.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | BrandingSpec is the cluster's brand. | |
spec.identity | object | Identity is the product's name and icons. | |
spec.identity.description | string | Description is the installed app's description. | |
spec.identity.icons | []object | Icons are the logo and favicon, as a manifest's icons: the first whose purpose includes "any" is the logo on the pages. | |
spec.identity.icons[].purpose | string | Purpose, as the manifest says it: any, maskable, monochrome. | |
spec.identity.icons[].sizes | string | Sizes, as the manifest says them: "any", or "192x192 512x512". | |
spec.identity.icons[].src | string | yes | Src is an https URL, or the image itself as a data URL. |
spec.identity.icons[].type | string | Type is the image's media type: one of those a data URL may carry. | |
spec.identity.name | string | Name is the product's name, on sign-in cards, page titles and the sender of the identity provider's mail. | |
spec.identity.shortName | string | ShortName is where Name does not fit: an installed app's label. | |
spec.tokens | object (free-form) | Tokens is the brand's look: a design-token document in the W3C Design Tokens Community Group format (2025.10). | |
status | object | BrandingStatus says whether the brand is what the pages show. | |
status.conditions | []object | Conditions: Rendered is True once the pages' stylesheet is the brand's, False with the reason when the tokens cannot be rendered. | |
status.conditions[].lastTransitionTime | string (date-time) | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer (int64) | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
status.conditions[].status | string | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.observedGeneration | integer (int64) | ObservedGeneration is the generation Rendered describes. |
6. BundleSource
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | bundlesources |
| Short names | bsrc |
BundleSource is a place outside the cluster that holds bundles: the cluster's, declared by its administrator and read to make a tenant; or a tenant's own (spec.tenant), declared by that tenant's administrator, written to by its exports and read for its recovery.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | BundleSourceSpec is S3 storage outside the cluster that holds bundles: the cluster's, which its administrator imports tenants from -- another cluster's… | |
spec.addressingStyle | string | AddressingStyle is how a bucket is named in a request to Endpoint: path (the default when empty) or virtualHost. | |
spec.bucket | string | yes | Bucket holds the bundles. |
spec.description | string | Description says what the storage is, for whoever picks a bundle from it. | |
spec.endpoint | string | yes | Endpoint is the S3 API URL, e.g. https://sos-ch-gva-2.exo.io. |
spec.prefix | string | Prefix is where in the bucket the bundles are, each one a prefix of its own directly below it. | |
spec.recipients | []string | Recipients are age public keys (age1…) a tenant's store holds its bundles readable by. | |
spec.region | string | Region, for a provider that requires one. | |
spec.tenant | string | Tenant makes this a tenant's own store, declared by its administrator, its keys in the tenant's part of the vault. | |
status | object | BundleSourceStatus reports whether the source can be read. | |
status.conditions | []object | Conditions carries Ready: whether bundles can be read from here. | |
status.conditions[].lastTransitionTime | string (date-time) | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer (int64) | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
status.conditions[].status | string | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.credentialRequirement | string | CredentialRequirement names the requirement carrying the keys, and CredentialSatisfied reports whether it has been filled. | |
status.credentialSatisfied | boolean | ||
status.observedGeneration | integer (int64) |
7. Component
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Namespaced |
| Plural | components |
| Short names | comp |
Component is an installed instance of a ComponentProfile.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | ComponentSpec is one installed instance of a ComponentProfile. | |
spec.addonPins | []object | AddonPins is the build each pinned addon was installed from, as the Tenant records it. | |
spec.addonPins[].catalogue | string | Catalogue is the catalog the pinned build was fetched from: the first half of its coordinate, <catalogue>/<name>. | |
spec.addonPins[].digest | string | yes | Digest pins the addon's profile bundle: the build the install asked for. |
spec.addonPins[].name | string | yes | Name is the addon's profile name, as addons lists it. |
spec.addons | []string | Addons enabled on this instance, by the profile's own names. | |
spec.class | string | yes | Class is the one mode this instance runs under. |
spec.config | object | Config is what this install overrides of the profile's defaults: the replica count and chart values the tenant chose. | |
spec.config.dropIns | []object | DropIns supply tenant-authored files into drop-in directories the target ComponentProfile declares as tenantEditable. | |
spec.config.dropIns[].files | map[string]string | yes | Files maps filename to content. |
spec.config.dropIns[].name | string | yes | Name must match a ComponentProfile.spec.customization.dropIns[].name entry that sets tenantEditable: true. |
spec.config.extraValues | object (free-form) | ExtraValues deep-merges Helm values over the profile's defaults. | |
spec.config.replicas | integer (int32) | Replicas overrides the default replica count. | |
spec.exposures | []object | Exposures are the entries of the profile a perimeter approver approved: the perimeter entries that are switched on, and the entries behind sign-in whose… | |
spec.exposures[].alias | string | Alias is the label of a second address for this surface directly under the cluster's own domain, copied from the Tenant's entry. | |
spec.exposures[].apex | boolean | Apex is the approver saying that this surface is for the cluster's main address (the bare domain), copied from the Tenant's entry. | |
spec.exposures[].expiresAt | string (date-time) | ExpiresAt ends the exposure, for one that was published for a while: at expiry the operator treats the enablement as absent, and the entry stays in git as… | |
spec.exposures[].exposureName | string | yes | ExposureName names an entry of the profile's expose list that asks for approval. |
spec.exposures[].kind | string | Kind is what was approved, copied from the Tenant's entry; empty is a public address. | |
spec.exposures[].owner | string | yes | Owner is the Keycloak subject that enabled the surface, set by the director from the caller's token. |
spec.exposures[].reviewAt | string (date-time) | yes | ReviewAt is when the owner and the perimeter approver look at it again, and it is always set: what is public is known and revisited, whether or not it ends. |
spec.fulfilment | string | Fulfilment pins how a tenant install is backed. | |
spec.movedAt | string | MovedAt and MovedBy are the request behind the current pin, as the tenant's manifest records them (TenantApp.MovedAt, MovedBy): when the pin was last moved… | |
spec.movedBy | string | ||
spec.privileges | []object | Privileges are the profile's privilege requests that a person granted. | |
spec.privileges[].approvedAt | string (date-time) | yes | |
spec.privileges[].approver | string | yes | Approver is the Keycloak subject who said yes, set by the director from the caller's token. |
spec.privileges[].digest | string | Digest pins an apiExtensions grant to the definitions it approved: sha256 of the request as the approver read it (security.APIExtensionDigest). | |
spec.privileges[].expiresAt | string (date-time) | ExpiresAt bounds the grant. | |
spec.privileges[].privilege | string | yes | Privilege names one entry of the profile's request, as <kind>/<name>, where kind is podSecurity, egress, clusterRoles or apiExtensions. |
spec.privileges[].reason | string | yes | Reason in the approver's words, not the profile's. |
spec.profileRef | object | yes | ProfileRef names the catalog entry this is an instance of. |
spec.profileRef.digest | string | Digest pins the profile bundle this instance was installed from. | |
spec.profileRef.name | string | yes | |
status | object | ComponentStatus is the observed state of a Component. | |
status.conditions | []object | ||
status.conditions[].lastTransitionTime | string (date-time) | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer (int64) | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
status.conditions[].status | string | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.fulfilment | string | Fulfilment is "dedicated" or "shared". | |
status.pendingPrivileges | []string | PendingPrivileges are requests of the profile that nobody has granted yet, as <kind>/<name>. | |
status.rollout | object | Rollout is which build this instance actually runs, and how the last move to the pinned build went. | |
status.rollout.digest | string | Digest is the build the instance runs: the last one that rolled out and verified. | |
status.rollout.export | string | Export names the TenantExport taken before the move, in the tenant's namespace. | |
status.rollout.finishedAt | string (date-time) | ||
status.rollout.message | string | ||
status.rollout.movedAt | string | MovedAt and MovedBy are the request this move answers, as the tenant's manifest records them. | |
status.rollout.movedBy | string | ||
status.rollout.phase | string | Phase is where the move to Target stands. | |
status.rollout.previous | string | Previous is the build the instance ran before the last move to Digest. | |
status.rollout.reason | string | Reason and Message say why a move was rolled back or failed. | |
status.rollout.startedAt | string (date-time) | StartedAt is when the pinned build began rolling out; FinishedAt when the move ended, either way. | |
status.rollout.target | string | Target is the build the move under way, or the last move, was to. |
8. ComponentProfile
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | componentprofiles |
| Short names | cprof |
ComponentProfile is a catalog entry for a system service, an app or an agent. The cluster holds only the profiles something installed refers to.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | ComponentProfileSpec is one catalog entry: what a component is, what it needs from the platform, and what it may expose. | |
spec.adapter | object | Adapter is what an adapter adapts. | |
spec.adapter.adapts | object | Adapts names the app whose interface this adapter uses: the app's ComponentProfile, which must be installed in the same tenant. | |
spec.adapter.adapts.profile | string | yes | Profile is the ComponentProfile of the app. |
spec.adapter.adapts.versions | []string | Versions are the catalog versions of the app this adapter was reviewed against. | |
spec.backup | object | Backup declares what a consistent copy of this component consists of. | |
spec.backup.boundSecrets | []object | BoundSecrets lists secrets this app's data is welded to: not derived, held outside the app's own captured data, and required to make sense of that data again. | |
spec.backup.boundSecrets[].keys | []string | Keys selects individual keys at that path. | |
spec.backup.boundSecrets[].openBaoPath | string | yes | OpenBaoPath is relative to this tenant's own prefix (gentian-os/tenants/{tenant}/), so a profile can only ever name secrets belonging to the tenant being… |
spec.backup.quiesce | object | Quiesce controls how writes are paused while the app is captured. | |
spec.backup.quiesce.container | string | Container names the container to run Pre and Post in. | |
spec.backup.quiesce.mode | string | Mode selects how writes are paused. | |
spec.backup.quiesce.post | []string | Post is the command that resumes writes. | |
spec.backup.quiesce.pre | []string | Pre is the command that pauses writes, required when mode is command. | |
spec.backup.restore | object | Restore declares what must run after this app's data is loaded and before it is resumed. | |
spec.backup.restore.domainBound | boolean | DomainBound says the app's data cannot be moved to another domain: it names the tenant's domain in a way the app refuses to run with another (a server name… | |
spec.backup.restore.post | [][]string | Post lists commands run in order once the app's data is loaded and before it is resumed — cache invalidation, re-indexing, fingerprinting, and rewriting what… | |
spec.backup.restore.verify | []string | Verify is a single command that must exit zero before the restore is reported successful. | |
spec.backup.volumes | object | Volumes narrows what is captured from the app's PersistentVolumeClaims. | |
spec.backup.volumes.excludePaths | []string | ExcludePaths drops matching paths from the captured archive, as glob patterns relative to each volume root. | |
spec.backup.volumes.include | []string | Include names the PersistentVolumeClaims to capture. | |
spec.classes | []string | yes | Classes lists the modes this component may be deployed under. |
spec.customization | object | Customization declares what a tenant may change about this component. | |
spec.customization.addon | object | Addon declares that this profile is an addon rather than a deployable app, and how the base activates it. | |
spec.customization.addon.id | string | yes | ID is what the hosting app's own addon system calls this addon: an Odoo module name, a Nextcloud app id, an XWiki extension. |
spec.customization.addon.of | string | yes | Of is the ComponentProfile name of the base this addon activates into. |
spec.customization.addonActivation | object | AddonActivation tells the platform how to turn a tenant's addon selection into Helm values for this base. | |
spec.customization.addonActivation.script | string | yes | Script is written to ValuesPath with the token GENTIAN_ADDON_IDS replaced by the space-separated addon ids. |
spec.customization.addonActivation.valuesPath | string | yes | ValuesPath is the dot-separated Helm values path the rendered Script is written to, e.g. "nextcloud.hooks.before-starting". |
spec.customization.addonValues | []object | AddonValues overlays extra Helm values onto this app's release when a given addon is selected. | |
spec.customization.addonValues[].values | object (free-form) | yes | Values are merged into the release values when that addon is selected, and omitted entirely when it is not. |
spec.customization.addonValues[].whenAddon | string | yes | WhenAddon is the app-side addon id — the value of spec.customization.addon.id on the addon's profile, e.g. "richdocuments", not the profile name. |
spec.customization.configure | object | Configure describes the L0 surface. | |
spec.customization.configure.hotReload | boolean | HotReload reports whether a values change applies without a restart. | |
spec.customization.configure.valuesSchema | string | ValuesSchema is the repo-relative path to the chart's values.schema.json. | |
spec.customization.dropIns | []object | DropIns declares the L1 surface: directories the app treats as extension points. | |
spec.customization.dropIns[].format | string | yes | Format is the content format expected in this directory. |
spec.customization.dropIns[].maxBytes | integer (int32) | MaxBytes caps the total tenant-supplied content for this drop-in. | |
spec.customization.dropIns[].name | string | yes | Name identifies the drop-in. |
spec.customization.dropIns[].path | string | yes | Path is the absolute in-container directory the files are mounted at. |
spec.customization.dropIns[].source | string | Source is the Kubernetes object the content is delivered through. | |
spec.customization.dropIns[].tenantEditable | boolean | TenantEditable allows tenant admins to supply files here through Tenant.spec.apps[].config.dropIns. | |
spec.customization.dropIns[].upstreamDocumented | boolean | UpstreamDocumented reports whether upstream documents this path as an extension point. | |
spec.customization.extension | object | Extension describes the L3 surface: the app's own addon system. | |
spec.customization.extension.addonPath | string | AddonPath is the in-container directory addons are loaded from (Odoo's custom-addons, Nextcloud's custom_apps). | |
spec.customization.extension.apiDocs | string | APIDocs links to the extension API documentation. | |
spec.customization.extension.apiStability | string | APIStability rates the extension API. | |
spec.customization.extension.delivery | []string | Delivery lists the supported ways an addon reaches the running app. | |
spec.customization.extension.mechanism | string | yes | Mechanism names the app's extension system (for example "odoo-addon", "nextcloud-app", "xwiki-extension"). |
spec.customization.extension.perTenantAddons | boolean | PerTenantAddons reports whether tenants may have divergent addon sets. | |
spec.customization.extension.registry | string | Registry is the repository or index addons are sourced from. | |
spec.customization.extension.testMatrix | []string | TestMatrix lists the upstream app versions addons are tested against. | |
spec.customization.fork | object | Fork describes the L6 surface: whether a fork is permitted, and who owns it. | |
spec.customization.fork.allowed | boolean | Allowed gates whether a fork is a permitted outcome for this app. | |
spec.customization.fork.cveWatch | boolean | CVEWatch reports whether the fork has active vulnerability monitoring. | |
spec.customization.fork.owner | string | Owner is the team or organization accountable for the fork, including its CVE response. | |
spec.customization.fork.repo | string | Repo is the Gentian-owned fork. | |
spec.customization.fork.upstream | string | Upstream is the project the fork diverged from. | |
spec.customization.grade | string | Grade rates customization readiness (see CustomizationGrade). | |
spec.customization.ladderDocs | string | LadderDocs links to human documentation of this app's ladder. | |
spec.customization.patch | object | Patch describes the L5 surface: whether a patch series is permitted. | |
spec.customization.patch.allowed | boolean | Allowed gates whether a patch series may be carried for this app at all. | |
spec.customization.patch.buildRepo | string | BuildRepo is the repository holding the pinned upstream and the series. | |
spec.customization.patch.requiresApproval | string | RequiresApproval names the role that must approve a new patch. | |
spec.customization.patch.seriesPath | string | SeriesPath is the repo-relative path to the quilt-style series file. | |
spec.customization.publishes | object | Publishes describes what this app offers so that another app can be built at L2 against it. | |
spec.customization.publishes.apis | []object | APIs lists the published interfaces a companion app can build against. | |
spec.customization.publishes.apis[].auth | string | Auth is the authentication method companions must use. | |
spec.customization.publishes.apis[].contract | string | yes | Contract is the Gentian contract name this API satisfies. |
spec.customization.publishes.apis[].path | string | Path is the base path the API is served at. | |
spec.customization.publishes.apis[].protocol | string | Protocol is the wire protocol (for example "http-json", "webdav", "matrix"). | |
spec.customization.publishes.apis[].spec | string | Spec names the interface description format (for example "openapi", "graphql"). | |
spec.customization.repackage | object | Repackage describes the L4 surface: who owns the packaging. | |
spec.customization.repackage.chartOwnership | string | ChartOwnership records whether the chart is upstream's, Gentian-authored, or a vendored copy. | |
spec.customization.repackage.compositionRef | string | CompositionRef names the profile-scoped Crossplane composition, when the app needs a custom managed-resource graph. | |
spec.customization.rubricScore | integer (int32) | RubricScore is the §4.1 rubric total backing Grade (0-8). | |
spec.customization.supportedRungs | []string | SupportedRungs lists the rungs at which this app can be customized. | |
spec.defaultForPlatform | boolean | DefaultForPlatform is placement {tenants: platform}. | |
spec.defaultForTenants | boolean | DefaultForTenants is placement {tenants: every}. | |
spec.defaultWhereStoreOffered | boolean | DefaultWhereStoreOffered is placement {tenants: users, while: storeOffered}. | |
spec.expose | []object | Expose declares entry points. | |
spec.expose[].annotations | map[string]string | Annotations are gateway policy for this host. | |
spec.expose[].apex | boolean | Apex publishes this entry on the cluster's bare domain -- its main address -- instead of a host under the zone's domain. | |
spec.expose[].authMode | string | yes | AuthMode is mandatory and has no default. |
spec.expose[].backend | object | yes | Backend is the Service the entry routes to. |
spec.expose[].backend.component | string | Component names another component whose Service this entry routes to. | |
spec.expose[].backend.port | integer (int32) | yes | |
spec.expose[].backend.service | string | yes | |
spec.expose[].clientAuthorization | string | ClientAuthorization says whose the Authorization header is on this entry. | |
spec.expose[].denyPaths | []string | DenyPaths are refused even where Paths admits them. | |
spec.expose[].exchangeToken | boolean | ExchangeToken asks the front door to hand this backend a token of the person that is valid at this app and nowhere else: the session's token exchanged at the… | |
spec.expose[].forwardToken | boolean | ForwardToken asks the gateway to pass the edge access token to this backend. | |
spec.expose[].name | string | yes | |
spec.expose[].paths | []string | Paths this entry serves. | |
spec.expose[].subDomain | string | SubDomain is the host label of this entry in the tenant's zone. | |
spec.expose[].surface | string | yes | Surface selects where this entry is published. |
spec.expose[].tile | object | Tile is how this entry appears on the portal, for an entry a person is meant to open. | |
spec.expose[].tile.description | string | Description is the sentence the portal shows beside the label. | |
spec.expose[].tile.displayName | string | yes | DisplayName is the label under the icon. |
spec.expose[].tile.displayNames | map[string]string | DisplayNames are translations of DisplayName, keyed by locale ("de_DE", "en_US"). | |
spec.expose[].tile.image | string | Image is the profile-relative path the PNG lives at in git, e.g. assets/tile.png. | |
spec.expose[].tile.logo | string | yes | Logo is the tile's default image: a square PNG, 128x128, inline as a data URI. |
spec.expose[].tile.object | string | Object is what Relation is checked against. | |
spec.expose[].tile.path | string | Path is where within the host the tile leads. | |
spec.expose[].tile.relation | string | yes | Relation is what the caller must hold, on the object Object names, for the tile to be on their page: a permission of the authorization model… |
spec.extensions | []object | Extensions are containers shipped inside the component's own pod: the only escape hatch, and one that cannot create a cluster-scoped object. | |
spec.extensions[].appSecrets | []object | AppSecrets are sidecar-internal secrets stored at gentian-os/tenants/{tenant}/apps/{parent}-{name}/internal/{secret}. | |
spec.extensions[].appSecrets[].name | string | yes | Name is the logical identifier for this secret (e.g., "admin_password"). |
spec.extensions[].appSecrets[].valuePath | string | yes | ValuePath is the dot-notation (or bracket-notation) Helm value key that should receive the generated secret value. |
spec.extensions[].chart | object | yes | Chart references the sidecar Helm chart. |
spec.extensions[].chart.name | string | yes | Name is the chart name within the repository. |
spec.extensions[].chart.repository | string | yes | Repository is the OCI repository URL (e.g., oci://registry.example.com/charts). |
spec.extensions[].chart.version | string | yes | Version is the chart version to deploy. |
spec.extensions[].extraValues | object (free-form) | ExtraValues are merged into the sidecar Helm release values. | |
spec.extensions[].kernelRequirements | object | ServiceRequirements declares kernel services the sidecar needs. | |
spec.extensions[].kernelRequirements.authorization | object | Authorization declares that the component keeps its own relations in an authorization store the platform makes for it. | |
spec.extensions[].kernelRequirements.authorization.groups | string | Groups "mirror" has the platform keep the tenant realm's group memberships in the store, as tuples group:<realm>/<group name>#member of… | |
spec.extensions[].kernelRequirements.authorization.model | string | yes | Model is the store's authorization model in the OpenFGA DSL ("model / schema 1.1 / type user / ..."). |
spec.extensions[].kernelRequirements.authorization.tuples | []object | Tuples are the store's starting tuples, written by the platform and held to the model when the profile is admitted. | |
spec.extensions[].kernelRequirements.authorization.tuples[].object | string | yes | |
spec.extensions[].kernelRequirements.authorization.tuples[].relation | string | yes | |
spec.extensions[].kernelRequirements.authorization.tuples[].user | string | yes | |
spec.extensions[].kernelRequirements.cache | object | Cache specifies a caching backend requirement. | |
spec.extensions[].kernelRequirements.cache.engine | string | Engine selects the caching backend. | |
spec.extensions[].kernelRequirements.database | object | Database specifies a relational database requirement. | |
spec.extensions[].kernelRequirements.database.allowDynamicDatabaseCreation | boolean | AllowDynamicDatabaseCreation lets the app create databases of its own at runtime. | |
spec.extensions[].kernelRequirements.database.connectionLimit | integer (int32) | ConnectionLimit is the most connections the app's account may hold at once on the shared server, which every tenant's apps use. | |
spec.extensions[].kernelRequirements.database.engine | string | Engine selects the database engine. | |
spec.extensions[].kernelRequirements.database.schemaPreference | string | SchemaPreference decides which schema the app's role resolves unqualified table names against first. | |
spec.extensions[].kernelRequirements.identity | object | Identity specifies OIDC requirements. | |
spec.extensions[].kernelRequirements.identity.oidc | object | OIDC describes the OIDC client to register in the tenant's Keycloak realm. | |
spec.extensions[].kernelRequirements.identity.oidc.accessType | string | AccessType controls whether the client requires a shared secret (CONFIDENTIAL, for server-side apps) or relies on PKCE without a secret (PUBLIC, for SPAs and… | |
spec.extensions[].kernelRequirements.identity.oidc.audiences | []string | Audiences are names the access tokens of this client carry in aud, beside what Keycloak puts there itself: the name a service the app hands its tokens to… | |
spec.extensions[].kernelRequirements.identity.oidc.backchannelLogout | object | BackchannelLogout says where in the app the realm tells it that a person signed out (OpenID Connect Back-Channel Logout). | |
spec.extensions[].kernelRequirements.identity.oidc.backchannelLogout.exposure | string | yes | Exposure names the entry of this profile (spec.expose) whose backend the path is served by. |
spec.extensions[].kernelRequirements.identity.oidc.backchannelLogout.path | string | yes | Path is the app's back-channel logout endpoint: a plain path. |
spec.extensions[].kernelRequirements.identity.oidc.backchannelLogoutUrl | string | BackchannelLogoutURL is withdrawn and refused: declare BackchannelLogout instead. | |
spec.extensions[].kernelRequirements.identity.oidc.clientId | string | yes | ClientID is the OIDC client identifier registered in Keycloak. |
spec.extensions[].kernelRequirements.identity.oidc.directAccessGrantsEnabled | boolean | DirectAccessGrantsEnabled enables the Resource Owner Password Credentials grant (legacy / CLI apps). | |
spec.extensions[].kernelRequirements.identity.oidc.name | string | Name is the human-readable display name shown in the Keycloak admin UI. | |
spec.extensions[].kernelRequirements.identity.oidc.oidcPackRef | string | OIDCPackRef selects a pack entry from an OIDCPackCatalog CR when the pack key differs from clientId. | |
spec.extensions[].kernelRequirements.identity.oidc.postLogoutRedirectUris | []string | PostLogoutRedirectURIs lists the allowed post-logout redirect URIs. | |
spec.extensions[].kernelRequirements.identity.oidc.redirectUris | []string | RedirectURIs lists the valid OAuth2 redirect URIs for the authorization code flow. | |
spec.extensions[].kernelRequirements.identity.oidc.requestParameter | object | RequestParameter binds an authorization-request parameter of this client's sign-ins to where the code is delivered, and puts it in the access token: for an… | |
spec.extensions[].kernelRequirements.identity.oidc.requestParameter.claim | string | Claim is the access-token claim the value is put in. | |
spec.extensions[].kernelRequirements.identity.oidc.requestParameter.name | string | yes | Name is the parameter, as the app sends it on the authorization request. |
spec.extensions[].kernelRequirements.identity.oidc.requestParameter.pattern | string | yes | Pattern is what the value must be, matched as a whole. |
spec.extensions[].kernelRequirements.identity.oidc.requestParameter.redirectUri | string | yes | RedirectURI is the one address a code for the request is delivered to: https, with at least one ${group} for a named group of the pattern's match, and no… |
spec.extensions[].kernelRequirements.identity.saml | object | SAML describes the SAML client to register in the tenant's Keycloak realm. | |
spec.extensions[].kernelRequirements.identity.saml.acsUrl | string | yes | ACSURL is the SAML Assertion Consumer Service URL for the auth callback. |
spec.extensions[].kernelRequirements.identity.saml.entityId | string | yes | EntityID is the SAML Service Provider Entity ID registered in Keycloak. |
spec.extensions[].kernelRequirements.identity.sidecar | object | Sidecar signs people in through the platform's sign-in sidecar. | |
spec.extensions[].kernelRequirements.identity.sidecar.appPort | integer (int32) | AppPort lets the handler call the app itself inside the cluster: it is the port the app's pods listen on, and the network path is opened to that port of the… | |
spec.extensions[].kernelRequirements.identity.sidecar.database | boolean | Database gives the handler the app's own database: where it is and the app's own login to it, as DB_HOST, DB_PORT, DB_NAME, DB_USER and DB_PASSWORD, and the… | |
spec.extensions[].kernelRequirements.identity.sidecar.entryPaths | []string | EntryPaths are paths of the app that lead to the sign-in instead of to the app: its front page, and the address of its own sign-in form. | |
spec.extensions[].kernelRequirements.identity.sidecar.exposure | string | Exposure names the gateway entry people open the app at: the sidecar's two paths are on that entry's host. | |
spec.extensions[].kernelRequirements.identity.sidecar.secrets | []string | Secrets gives the handler secrets of this app, by the names they have under spec.secrets.generated: each as SECRET_<NAME>, the name in upper case. | |
spec.extensions[].kernelRequirements.llm | object | LLM declares that the component calls language models through the platform's model gateway. | |
spec.extensions[].kernelRequirements.llm.optional | boolean | Optional means the component runs without the gateway. | |
spec.extensions[].kernelRequirements.logDestination | object | LogDestination declares that the component receives the platform's log forwarder over HTTPS inside the cluster. | |
spec.extensions[].kernelRequirements.logDestination.port | integer (int32) | yes | Port is the port that Service and its pods serve HTTPS on, the same number on both: it is the pods' port the network admits. |
spec.extensions[].kernelRequirements.logDestination.service | string | yes | Service is the name of the component's Service the forwarder is sent to. |
spec.extensions[].kernelRequirements.mail | object | Mail specifies SMTP and/or IMAP requirements. | |
spec.extensions[].kernelRequirements.mail.imap | object | IMAP requests inbound mail (IMAP) credentials. | |
spec.extensions[].kernelRequirements.mail.imap.tokenSignIn | boolean | TokenSignIn declares that the app opens a person's mailbox with that person's sign-in token (SASL XOAUTH2) instead of an app password. | |
spec.extensions[].kernelRequirements.mail.smtp | object | SMTP requests outbound mail (SMTP submission) credentials. | |
spec.extensions[].kernelRequirements.mcp | object | MCP declares that the component exposes a Model Context Protocol endpoint. | |
spec.extensions[].kernelRequirements.mcp.auth | string | Auth is the authentication method the endpoint expects. | |
spec.extensions[].kernelRequirements.mcp.enabled | boolean | yes | Enabled says the component exposes the endpoint. |
spec.extensions[].kernelRequirements.mcp.endpoint | string | Endpoint is the HTTP path where the app exposes its MCP server. | |
spec.extensions[].kernelRequirements.partners | object | Partners declares that the component calls apps of partner realms on a person's behalf, takes such calls, or commissions partners of other tenants. | |
spec.extensions[].kernelRequirements.partners.accept | boolean | Accept says the component takes partners' assertions, turning each into the linked local account by the JWT authorization grant, for every partner the tenant… | |
spec.extensions[].kernelRequirements.partners.call | []string | Call names the tenant's partners the component asks assertions towards (standard token exchange, scope partner-<name>): a person's token in, a token for the… | |
spec.extensions[].kernelRequirements.partners.commission | boolean | Commission says the component asks the director to add receiving partners to the tenants that name it, or to take them away. | |
spec.extensions[].kernelRequirements.partners.serviceAccount | string | ServiceAccount is the Kubernetes service account the component's pods run as; its token is the client's credential. | |
spec.extensions[].kernelRequirements.rights | object | Rights declares that the component asks the platform whether a person may use an app of its tenant, for a person who is not at a browser. | |
spec.extensions[].kernelRequirements.rights.audit | boolean | Audit lets the same key ask three more questions, for a person of the platform tenant: may they audit the cluster (cluster#can_audit), may they configure it… | |
spec.extensions[].kernelRequirements.storage | object | Storage specifies object storage (S3) and/or filesystem (WebDAV) requirements. | |
spec.extensions[].kernelRequirements.storage.files | object | Files requests WebDAV access to the tenant's file-storage service. | |
spec.extensions[].kernelRequirements.storage.files.capabilities | []string | Capabilities lists the required access capabilities. | |
spec.extensions[].kernelRequirements.storage.files.protocol | string | Protocol is the access protocol. | |
spec.extensions[].kernelRequirements.storage.s3 | object | S3 requests a per-tenant S3 bucket from the platform's object store. | |
spec.extensions[].kernelRequirements.storage.s3.objectLock | boolean | ObjectLock makes the bucket with S3 Object Lock, which cannot be switched off again, and lets the app read and set the bucket's default retention… | |
spec.extensions[].kernelRequirements.turn | object | TURN declares that the component's clients relay real-time media through the platform's TURN edge. | |
spec.extensions[].kernelRequirements.vouching | object | Vouching declares that the component obtains tokens of a person who is not at a browser, on the strength of that person's earlier consent: it signs a short… | |
spec.extensions[].kernelRequirements.vouching.director | []string | Director names what a token the component obtains for a person may do at the platform's own API, beside the apps: plans-read reads the cluster's plans, its… | |
spec.extensions[].kernelRequirements.vouching.keys | object | yes | Keys says where the component publishes the keys its statements are signed with, as a JWKS. |
spec.extensions[].kernelRequirements.vouching.keys.path | string | Path is where the JWKS is served. | |
spec.extensions[].kernelRequirements.vouching.keys.port | integer (int32) | yes | Port is the Service's port. |
spec.extensions[].kernelRequirements.vouching.keys.service | string | yes | Service is the name of the component's Service. |
spec.extensions[].name | string | yes | Name identifies the sidecar (e.g. |
spec.extensions[].stableServiceName | string | StableServiceName is the Kubernetes Service name the tenant ingress reconciler routes to (e.g. | |
spec.extensions[].stableServicePort | integer (int32) | StableServicePort is the port on StableServiceName. | |
spec.extensions[].valueMapping | object | ValueMapping places what the platform granted the sidecar into its chart's values, as package.valueMapping does for the app. | |
spec.extensions[].valueMapping.oidc | object | OIDC maps the sidecar's OIDC client to Helm keys, as the app's own valueMapping.oidc does. | |
spec.extensions[].valueMapping.oidc.clientIdKey | string | ClientIDKey is the Helm value key for the OIDC client ID. | |
spec.extensions[].valueMapping.oidc.clientSecretKey | string | ClientSecretKey is the Helm value key for the OIDC client secret. | |
spec.extensions[].valueMapping.oidc.clientSecretOpenbaoPath | string | ClientSecretOpenbaoPath overrides the default per-tenant OpenBao secret path (gentian-os/tenants/{tenant}/apps/{app}/oidc) for reading the OIDC client secret. | |
spec.extensions[].valueMapping.oidc.clientSecretOpenbaoProperty | string | ClientSecretOpenbaoProperty overrides the property name within the OpenBao secret (default: "client-secret"). | |
spec.extensions[].valueMapping.oidc.issuerKey | string | IssuerKey is the Helm value key for the OIDC issuer URL. | |
spec.hooks | object | Hooks are lifecycle actions at install, upgrade and resync. | |
spec.hooks.postInstall | object | PostInstall runs once after the component is first ready. | |
spec.hooks.postInstall.envFrom | []string | EnvFrom names Secrets already present in the tenant namespace to inject wholesale (matches how this app's own secrets already land — e.g.… | |
spec.hooks.postInstall.image | string | yes | Image is the container image the Job runs. |
spec.hooks.postInstall.readOnlyPVC | object | ReadOnlyPVC optionally mounts an existing PersistentVolumeClaim read-only, for the rare case a bootstrap script needs information only available in the app's… | |
spec.hooks.postInstall.readOnlyPVC.claimName | string | yes | ClaimName is the PersistentVolumeClaim name in the tenant namespace. |
spec.hooks.postInstall.readOnlyPVC.mountPath | string | yes | MountPath is where the claim is mounted read-only in the Job container. |
spec.hooks.postInstall.script | string | yes | Script is the shell script body, run via /bin/sh -c. |
spec.hooks.postInstall.serviceAccountName | string | ServiceAccountName runs the Job under an existing ServiceAccount in the tenant namespace (e.g. | |
spec.hooks.provisioning | object | Provisioning configures the component through its own API after install and on resync. | |
spec.hooks.provisioning.privilegedRole | object | PrivilegedRole maps gentian:tenant:<t>:app-admins members to an in-app administrator role (for example the Nextcloud "admin" group). | |
spec.hooks.provisioning.privilegedRole.kind | string | yes | Kind is the application's native role type. |
spec.hooks.provisioning.privilegedRole.name | string | yes | Name is the in-app role identifier (for example Nextcloud group "admin"). |
spec.hooks.provisioning.syncJob | object | SyncJob is how this app applies PrivilegedRole. | |
spec.hooks.provisioning.syncJob.env | []object | Env binds individual Secret keys to environment variables. | |
spec.hooks.provisioning.syncJob.env[].name | string | yes | Name of the environment variable. |
spec.hooks.provisioning.syncJob.env[].secretKeyRef | object | yes | SecretKeyRef is the Secret key to read it from. |
spec.hooks.provisioning.syncJob.env[].secretKeyRef.key | string | yes | |
spec.hooks.provisioning.syncJob.env[].secretKeyRef.name | string | yes | |
spec.hooks.provisioning.syncJob.envFrom | []string | EnvFrom names Secrets in the tenant namespace whose keys become environment variables. | |
spec.hooks.provisioning.syncJob.image | string | yes | Image the script runs in. |
spec.hooks.provisioning.syncJob.script | string | yes | Script executed with /bin/sh. |
spec.hooks.provisioning.syncJob.serviceAccountName | string | ServiceAccountName runs the Job under an existing ServiceAccount. | |
spec.integrations | []object | Integrations are opportunistic relationships with peer components. | |
spec.integrations[].capabilities | []string | Capabilities lists the specific capabilities required from the contract. | |
spec.integrations[].contract | string | yes | Contract is the name of the contract to consume. |
spec.integrations[].provider | string | Provider is the expected provider app by profile name. | |
spec.launch | string | yes | Launch is how a person reaches this component. |
spec.package | object | yes | Package is how the component is deployed. |
spec.package.addon | object | Addon describes a component the platform does not deploy at all: it flips a switch inside another component's own addon system. | |
spec.package.addon.id | string | yes | ID is what the hosting component's own addon system calls this addon: an Odoo module name, a Nextcloud app id, an XWiki extension. |
spec.package.addon.of | string | yes | Of is the ComponentProfile this addon activates into. |
spec.package.api | object | API describes a component the platform routes to rather than runs. | |
spec.package.api.baseUrl | string | yes | BaseURL is the external service origin (e.g. |
spec.package.api.runtime | string | Runtime selects how the tenant reaches the external service. | |
spec.package.api.tenantBinding | string | TenantBinding declares how the tenant is identified to the external service. | |
spec.package.api.tile | object | Tile puts this entry on the desktop of whoever holds its relation. | |
spec.package.api.tile.description | string | Description is the sentence the portal shows beside the label. | |
spec.package.api.tile.displayName | string | yes | DisplayName is the label under the icon. |
spec.package.api.tile.displayNames | map[string]string | DisplayNames are translations of DisplayName, keyed by locale ("de_DE", "en_US"). | |
spec.package.api.tile.image | string | Image is the profile-relative path the PNG lives at in git, e.g. assets/tile.png. | |
spec.package.api.tile.logo | string | yes | Logo is the tile's default image: a square PNG, 128x128, inline as a data URI. |
spec.package.api.tile.object | string | Object is what Relation is checked against. | |
spec.package.api.tile.path | string | Path is where within the host the tile leads. | |
spec.package.api.tile.relation | string | yes | Relation is what the caller must hold, on the object Object names, for the tile to be on their page: a permission of the authorization model… |
spec.package.chart | object | Chart is the Helm chart or OCI artifact. | |
spec.package.chart.name | string | yes | Name is the chart name within the repository. |
spec.package.chart.repository | string | yes | Repository is the OCI repository URL (e.g., oci://registry.example.com/charts). |
spec.package.chart.version | string | yes | Version is the chart version to deploy. |
spec.package.composition | string | Composition names a Crossplane composition, for a component that is not a single chart. | |
spec.package.extraValues | object (free-form) | ExtraValues are static chart values. | |
spec.package.images | []object | Images are the private images the component runs, each at the one build it may run. | |
spec.package.images[].digest | string | yes | Digest is the build. |
spec.package.images[].repository | string | yes | Repository is the image's address without a tag. |
spec.package.valueMapping | object | ValueMapping places what the platform granted into the chart's values. | |
spec.package.valueMapping.cache | object | Cache maps caching backend values to Helm keys. | |
spec.package.valueMapping.cache.hostKey | string | HostKey is the Helm value key for the cache host. | |
spec.package.valueMapping.cache.passwordKey | string | PasswordKey is the Helm value key for the cache password/ACL token. | |
spec.package.valueMapping.cache.portKey | string | PortKey is the Helm value key for the cache port. | |
spec.package.valueMapping.cache.userKey | string | UserKey is the Helm value key for the cache ACL username. | |
spec.package.valueMapping.database | object | Database maps database connection values to Helm keys. | |
spec.package.valueMapping.database.hostKey | string | ||
spec.package.valueMapping.database.nameKey | string | NameKey is the Helm value key for the database name. | |
spec.package.valueMapping.database.passwordKey | string | PasswordKey is the Helm value key for the database password. | |
spec.package.valueMapping.database.portKey | string | PortKey is the Helm value key for the database port. | |
spec.package.valueMapping.database.readNameKey | string | ReadNameKey is the Helm value key for the read-replica database name. | |
spec.package.valueMapping.database.readUserKey | string | ReadUserKey is the Helm value key for the read-replica database user. | |
spec.package.valueMapping.database.secretNameKey | string | HostKey is the Helm value key for the database host. | |
spec.package.valueMapping.database.userKey | string | UserKey is the Helm value key for the database user. | |
spec.package.valueMapping.imap | object | IMAP maps mail access values to Helm keys. | |
spec.package.valueMapping.imap.hostKey | string | HostKey is the Helm value key for the IMAP host. | |
spec.package.valueMapping.imap.portKey | string | PortKey is the Helm value key for the IMAP port. | |
spec.package.valueMapping.integrations | map[string]object | Integrations maps optional integration credentials to Helm keys, keyed by the contract name. | |
spec.package.valueMapping.integrations{}.endpointKey | string | EndpointKey is the Helm value key for the integration's service endpoint URL. | |
spec.package.valueMapping.integrations{}.passwordKey | string | PasswordKey is the Helm value key for the integration password. | |
spec.package.valueMapping.integrations{}.userKey | string | UserKey is the Helm value key for the integration username. | |
spec.package.valueMapping.llm | object | LLM maps the model gateway's address and the component's key to Helm keys, for a component that declares requires.services.llm. | |
spec.package.valueMapping.llm.apiKeyKey | string | APIKeyKey is the Helm value key for the key the component presents. | |
spec.package.valueMapping.llm.availableKey | string | AvailableKey receives true when the gateway's address and the component's key are delivered, and false while an optional requirement… | |
spec.package.valueMapping.llm.baseUrlKey | string | BaseURLKey is the Helm value key for the gateway's OpenAI-compatible base address (it ends in /v1). | |
spec.package.valueMapping.llm.secretNameKey | string | SecretNameKey receives the NAME of the Secret the component's model credentials are in (llm-credentials-<component>, in the component's namespace; the key is… | |
spec.package.valueMapping.oidc | object | OIDC maps OIDC provider values to Helm keys. | |
spec.package.valueMapping.oidc.clientIdKey | string | ClientIDKey is the Helm value key for the OIDC client ID. | |
spec.package.valueMapping.oidc.clientSecretKey | string | ClientSecretKey is the Helm value key for the OIDC client secret. | |
spec.package.valueMapping.oidc.clientSecretOpenbaoPath | string | ClientSecretOpenbaoPath overrides the default per-tenant OpenBao secret path (gentian-os/tenants/{tenant}/apps/{app}/oidc) for reading the OIDC client secret. | |
spec.package.valueMapping.oidc.clientSecretOpenbaoProperty | string | ClientSecretOpenbaoProperty overrides the property name within the OpenBao secret (default: "client-secret"). | |
spec.package.valueMapping.oidc.issuerKey | string | IssuerKey is the Helm value key for the OIDC issuer URL. | |
spec.package.valueMapping.platform | object | Platform maps the facts of the cluster a component runs in to Helm keys: which zone it is served in, which realm signs that zone's tokens, where the director… | |
spec.package.valueMapping.platform.audienceKey | string | AudienceKey receives the audience the forwarded edge token carries, so a backend can require it rather than accept any token the realm signs. | |
spec.package.valueMapping.platform.clusterKey | string | ClusterKey receives the id the director knows this cluster by. | |
spec.package.valueMapping.platform.countryKey | string | CountryKey receives the tenant's country (spec.country), an ISO 3166-1 alpha-2 code in upper case, and the empty string while the tenant names none. | |
spec.package.valueMapping.platform.custodianUrlKey | string | CustodianURLKey receives the custodian's in-cluster URL. | |
spec.package.valueMapping.platform.defaultLanguageKey | string | DefaultLanguageKey receives the tenant's own language, as an ISO 639-1 code (AD-15). | |
spec.package.valueMapping.platform.desktopUrlKey | string | DesktopURLKey receives the in-cluster address of the API of the desktop in the component's own namespace, from the desktop profile's "api" entry: http://<its… | |
spec.package.valueMapping.platform.directorUrlKey | string | DirectorURLKey receives the director's in-cluster URL. | |
spec.package.valueMapping.platform.hostKey | string | HostKey receives the host this component answers on in its zone: the host of its first gateway entry, as the operator routes it. | |
spec.package.valueMapping.platform.issuerKey | string | IssuerKey receives the zone's OIDC issuer, the realm on the identity provider whose tokens the edge forwards. | |
spec.package.valueMapping.platform.kernelDomainKey | string | KernelDomainKey receives the cluster's kernel domain. | |
spec.package.valueMapping.platform.organizationKey | string | OrganizationKey receives who the tenant is, as one object: displayName, legalName, country, languages (the first is the tenant's own), currency, timeZone… | |
spec.package.valueMapping.platform.realmKey | string | RealmKey receives the name of the zone's realm. | |
spec.package.valueMapping.platform.registrarUrlKey | string | RegistrarURLKey receives the registrar's in-cluster URL: where a console relays, with the person's own token, the managing of a tenant's people and groups. | |
spec.package.valueMapping.platform.storeUrlKey | string | StoreURLKey receives the base address of the App Store API this cluster names (the Cluster claim's spec.catalogue.storeUrl), and the empty string while the… | |
spec.package.valueMapping.platform.tenantKey | string | TenantKey receives the name of the tenant the component runs in. | |
spec.package.valueMapping.platform.tenantUIDKey | string | TenantUIDKey receives the tenant's unique id, its metadata.uid: the id the usage statistics report names it by, and the one the store keys its sign-in through… | |
spec.package.valueMapping.platform.timeZoneKey | string | TimeZoneKey receives the tenant's time zone (spec.organization.timeZone), an IANA name, for a chart that takes only the zone, such as a TZ variable. | |
spec.package.valueMapping.platform.usherUrlKey | string | UsherURLKey receives the usher's in-cluster URL: where a desktop asks, with the person's own token, what that person may open. | |
spec.package.valueMapping.platform.zoneClientIdKey | string | ZoneClientIDKey receives the client id the edge holds the zone's session with. | |
spec.package.valueMapping.platform.zoneKindKey | string | ZoneKindKey receives "kernel" for a component served in the kernel zone and "tenant" otherwise. | |
spec.package.valueMapping.s3 | object | S3 maps object storage values to Helm keys. | |
spec.package.valueMapping.s3.accessKeyKey | string | AccessKeyKey is the Helm value key for the S3 access key ID. | |
spec.package.valueMapping.s3.bucketKey | string | BucketKey is the Helm value key for the bucket name. | |
spec.package.valueMapping.s3.endpointKey | string | EndpointKey is the Helm value key for the S3 endpoint URL. | |
spec.package.valueMapping.s3.regionKey | string | RegionKey is the Helm value key for the S3 region. | |
spec.package.valueMapping.s3.secretKeyKey | string | SecretKeyKey is the Helm value key for the S3 secret access key. | |
spec.package.valueMapping.smtp | object | SMTP maps mail submission values to Helm keys. | |
spec.package.valueMapping.smtp.hostKey | string | HostKey is the Helm value key for the SMTP host. | |
spec.package.valueMapping.smtp.passwordKey | string | PasswordKey is the Helm value key for the SMTP password. | |
spec.package.valueMapping.smtp.portKey | string | PortKey is the Helm value key for the SMTP port. | |
spec.package.valueMapping.smtp.userKey | string | UserKey is the Helm value key for the SMTP username. | |
spec.package.valueMapping.volumes | object | Volumes names where this chart takes extra pod volumes and mounts, for charts that do not use the conventional extraVolumes/extraVolumeMounts. | |
spec.package.valueMapping.volumes.volumeMountsPath | string | VolumeMountsPath is the dot-separated values path holding a list of container volume mounts (e.g. | |
spec.package.valueMapping.volumes.volumesPath | string | VolumesPath is the dot-separated values path holding a list of pod volumes (e.g. | |
spec.placement | object | Placement makes this a component the platform places, and says where. | |
spec.placement.tenants | string | yes | Tenants are the tenants that get the component. |
spec.placement.while | string | While names the condition the placement lasts for; absent, it lasts for the life of each tenant. | |
spec.provides | []object | Provides lists the contracts this component supplies. | |
spec.provides[].endpoint | object | Endpoint is where this component answers the contract in the tenant's namespace. | |
spec.provides[].endpoint.path | string | Path is appended to the address the consumer is told, for an API served below the root. | |
spec.provides[].endpoint.port | integer (int32) | yes | Port is the Service's port, and must be the port the provider's pods listen on: a network policy matches the port a pod listens on, and the way it opens is to… |
spec.provides[].endpoint.service | string | yes | Service is the provider's Service, in the namespace it is installed in. |
spec.provides[].name | string | yes | Name is the contract name (e.g., "file-store", "project-management"). |
spec.provides[].protocol | string | Protocol is the technical protocol used (e.g., "http-json", "webdav"). | |
spec.requires | object | Requires is what the platform is obliged to provide before this component may run. | |
spec.requires.platform | string | Platform is the oldest platform version line this build runs on, as a floor: ">=0.5", or "0.5" which means the same. | |
spec.requires.privileges | object | Privileges escape the default posture. | |
spec.requires.privileges.apiExtensions | []object | APIExtensions are resource types the component adds to the cluster's API. | |
spec.requires.privileges.apiExtensions[].definitions | []object (free-form) | yes | Definitions are the CustomResourceDefinitions, apiextensions.k8s.io/v1, as they are installed. |
spec.requires.privileges.apiExtensions[].group | string | yes | Group is the API group every definition is in: the add-on's own, never one of Kubernetes' or the platform's. |
spec.requires.privileges.apiExtensions[].name | string | yes | Name is what a PrivilegeGrant refers to (apiExtensions/<name>). |
spec.requires.privileges.apiExtensions[].reason | string | yes | Reason is what the approver reads. |
spec.requires.privileges.apiExtensions[].serviceAccount | string | yes | ServiceAccount is the account the component's chart runs its pods under, in the component's namespace: the one that reads the types and writes their status. |
spec.requires.privileges.clusterRoles | []object | ClusterRoles the component's ServiceAccount needs. | |
spec.requires.privileges.clusterRoles[].name | string | yes | Name is the platform's name of the role, and what a PrivilegeGrant refers to (clusterRoles/<name>). |
spec.requires.privileges.clusterRoles[].reason | string | yes | Reason is what the approver reads. |
spec.requires.privileges.clusterRoles[].rules | []object | Rules is not used. | |
spec.requires.privileges.clusterRoles[].rules[].apiGroups | []string | APIGroups is the name of the APIGroup that contains the resources. | |
spec.requires.privileges.clusterRoles[].rules[].nonResourceURLs | []string | NonResourceURLs is a set of partial urls that a user should have access to. | |
spec.requires.privileges.clusterRoles[].rules[].resourceNames | []string | ResourceNames is an optional white list of names that the rule applies to. | |
spec.requires.privileges.clusterRoles[].rules[].resources | []string | Resources is a list of resources this rule applies to. | |
spec.requires.privileges.clusterRoles[].rules[].verbs | []string | yes | Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. |
spec.requires.privileges.clusterRoles[].serviceAccount | string | ServiceAccount is the ServiceAccount the component's chart runs its pods under, in the component's namespace. | |
spec.requires.privileges.egress | []object | Egress opens outbound network beyond the tenant baseline. | |
spec.requires.privileges.egress[].name | string | yes | Name is what a PrivilegeGrant refers to. |
spec.requires.privileges.egress[].reason | string | yes | Reason is what the approver reads. |
spec.requires.privileges.egress[].rule | object | yes | Rule is the egress to allow. |
spec.requires.privileges.egress[].rule.ports | []object | ports is a list of destination ports for outgoing traffic. | |
spec.requires.privileges.egress[].rule.ports[].endPort | integer (int32) | endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. | |
spec.requires.privileges.egress[].rule.ports[].port | int-or-string | port represents the port on the given protocol. | |
spec.requires.privileges.egress[].rule.ports[].protocol | string | protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. | |
spec.requires.privileges.egress[].rule.to | []object | to is a list of destinations for outgoing traffic of pods selected for this rule. | |
spec.requires.privileges.egress[].rule.to[].ipBlock | object | ipBlock defines policy on a particular IPBlock. | |
spec.requires.privileges.egress[].rule.to[].ipBlock.cidr | string | yes | cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" |
spec.requires.privileges.egress[].rule.to[].ipBlock.except | []string | except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected… | |
spec.requires.privileges.egress[].rule.to[].namespaceSelector | object | namespaceSelector selects namespaces using cluster-scoped labels. | |
spec.requires.privileges.egress[].rule.to[].namespaceSelector.matchExpressions | []object | matchExpressions is a list of label selector requirements. | |
spec.requires.privileges.egress[].rule.to[].namespaceSelector.matchExpressions[].key | string | yes | key is the label key that the selector applies to. |
spec.requires.privileges.egress[].rule.to[].namespaceSelector.matchExpressions[].operator | string | yes | operator represents a key's relationship to a set of values. |
spec.requires.privileges.egress[].rule.to[].namespaceSelector.matchExpressions[].values | []string | values is an array of string values. | |
spec.requires.privileges.egress[].rule.to[].namespaceSelector.matchLabels | map[string]string | matchLabels is a map of {key,value} pairs. | |
spec.requires.privileges.egress[].rule.to[].podSelector | object | podSelector is a label selector which selects pods. | |
spec.requires.privileges.egress[].rule.to[].podSelector.matchExpressions | []object | matchExpressions is a list of label selector requirements. | |
spec.requires.privileges.egress[].rule.to[].podSelector.matchExpressions[].key | string | yes | key is the label key that the selector applies to. |
spec.requires.privileges.egress[].rule.to[].podSelector.matchExpressions[].operator | string | yes | operator represents a key's relationship to a set of values. |
spec.requires.privileges.egress[].rule.to[].podSelector.matchExpressions[].values | []string | values is an array of string values. | |
spec.requires.privileges.egress[].rule.to[].podSelector.matchLabels | map[string]string | matchLabels is a map of {key,value} pairs. | |
spec.requires.privileges.podSecurity | []object | PodSecurity waives a named admission policy for a named part of the component. | |
spec.requires.privileges.podSecurity[].name | string | yes | Name is what a PrivilegeGrant refers to. |
spec.requires.privileges.podSecurity[].policy | string | yes | Policy is the ClusterPolicy this waives. |
spec.requires.privileges.podSecurity[].reason | string | yes | Reason is what the approver reads. |
spec.requires.privileges.podSecurity[].scope | string | yes | Scope is the container or composition part it is waived for. |
spec.requires.services | object | Services are what the platform must fulfill before this component runs: identity, database, object storage, cache, mail, MCP. | |
spec.requires.services.authorization | object | Authorization declares that the component keeps its own relations in an authorization store the platform makes for it. | |
spec.requires.services.authorization.groups | string | Groups "mirror" has the platform keep the tenant realm's group memberships in the store, as tuples group:<realm>/<group name>#member of… | |
spec.requires.services.authorization.model | string | yes | Model is the store's authorization model in the OpenFGA DSL ("model / schema 1.1 / type user / ..."). |
spec.requires.services.authorization.tuples | []object | Tuples are the store's starting tuples, written by the platform and held to the model when the profile is admitted. | |
spec.requires.services.authorization.tuples[].object | string | yes | |
spec.requires.services.authorization.tuples[].relation | string | yes | |
spec.requires.services.authorization.tuples[].user | string | yes | |
spec.requires.services.cache | object | Cache specifies a caching backend requirement. | |
spec.requires.services.cache.engine | string | Engine selects the caching backend. | |
spec.requires.services.database | object | Database specifies a relational database requirement. | |
spec.requires.services.database.allowDynamicDatabaseCreation | boolean | AllowDynamicDatabaseCreation lets the app create databases of its own at runtime. | |
spec.requires.services.database.connectionLimit | integer (int32) | ConnectionLimit is the most connections the app's account may hold at once on the shared server, which every tenant's apps use. | |
spec.requires.services.database.engine | string | Engine selects the database engine. | |
spec.requires.services.database.schemaPreference | string | SchemaPreference decides which schema the app's role resolves unqualified table names against first. | |
spec.requires.services.identity | object | Identity specifies OIDC requirements. | |
spec.requires.services.identity.oidc | object | OIDC describes the OIDC client to register in the tenant's Keycloak realm. | |
spec.requires.services.identity.oidc.accessType | string | AccessType controls whether the client requires a shared secret (CONFIDENTIAL, for server-side apps) or relies on PKCE without a secret (PUBLIC, for SPAs and… | |
spec.requires.services.identity.oidc.audiences | []string | Audiences are names the access tokens of this client carry in aud, beside what Keycloak puts there itself: the name a service the app hands its tokens to… | |
spec.requires.services.identity.oidc.backchannelLogout | object | BackchannelLogout says where in the app the realm tells it that a person signed out (OpenID Connect Back-Channel Logout). | |
spec.requires.services.identity.oidc.backchannelLogout.exposure | string | yes | Exposure names the entry of this profile (spec.expose) whose backend the path is served by. |
spec.requires.services.identity.oidc.backchannelLogout.path | string | yes | Path is the app's back-channel logout endpoint: a plain path. |
spec.requires.services.identity.oidc.backchannelLogoutUrl | string | BackchannelLogoutURL is withdrawn and refused: declare BackchannelLogout instead. | |
spec.requires.services.identity.oidc.clientId | string | yes | ClientID is the OIDC client identifier registered in Keycloak. |
spec.requires.services.identity.oidc.directAccessGrantsEnabled | boolean | DirectAccessGrantsEnabled enables the Resource Owner Password Credentials grant (legacy / CLI apps). | |
spec.requires.services.identity.oidc.name | string | Name is the human-readable display name shown in the Keycloak admin UI. | |
spec.requires.services.identity.oidc.oidcPackRef | string | OIDCPackRef selects a pack entry from an OIDCPackCatalog CR when the pack key differs from clientId. | |
spec.requires.services.identity.oidc.postLogoutRedirectUris | []string | PostLogoutRedirectURIs lists the allowed post-logout redirect URIs. | |
spec.requires.services.identity.oidc.redirectUris | []string | RedirectURIs lists the valid OAuth2 redirect URIs for the authorization code flow. | |
spec.requires.services.identity.oidc.requestParameter | object | RequestParameter binds an authorization-request parameter of this client's sign-ins to where the code is delivered, and puts it in the access token: for an… | |
spec.requires.services.identity.oidc.requestParameter.claim | string | Claim is the access-token claim the value is put in. | |
spec.requires.services.identity.oidc.requestParameter.name | string | yes | Name is the parameter, as the app sends it on the authorization request. |
spec.requires.services.identity.oidc.requestParameter.pattern | string | yes | Pattern is what the value must be, matched as a whole. |
spec.requires.services.identity.oidc.requestParameter.redirectUri | string | yes | RedirectURI is the one address a code for the request is delivered to: https, with at least one ${group} for a named group of the pattern's match, and no… |
spec.requires.services.identity.saml | object | SAML describes the SAML client to register in the tenant's Keycloak realm. | |
spec.requires.services.identity.saml.acsUrl | string | yes | ACSURL is the SAML Assertion Consumer Service URL for the auth callback. |
spec.requires.services.identity.saml.entityId | string | yes | EntityID is the SAML Service Provider Entity ID registered in Keycloak. |
spec.requires.services.identity.sidecar | object | Sidecar signs people in through the platform's sign-in sidecar. | |
spec.requires.services.identity.sidecar.appPort | integer (int32) | AppPort lets the handler call the app itself inside the cluster: it is the port the app's pods listen on, and the network path is opened to that port of the… | |
spec.requires.services.identity.sidecar.database | boolean | Database gives the handler the app's own database: where it is and the app's own login to it, as DB_HOST, DB_PORT, DB_NAME, DB_USER and DB_PASSWORD, and the… | |
spec.requires.services.identity.sidecar.entryPaths | []string | EntryPaths are paths of the app that lead to the sign-in instead of to the app: its front page, and the address of its own sign-in form. | |
spec.requires.services.identity.sidecar.exposure | string | Exposure names the gateway entry people open the app at: the sidecar's two paths are on that entry's host. | |
spec.requires.services.identity.sidecar.secrets | []string | Secrets gives the handler secrets of this app, by the names they have under spec.secrets.generated: each as SECRET_<NAME>, the name in upper case. | |
spec.requires.services.llm | object | LLM declares that the component calls language models through the platform's model gateway. | |
spec.requires.services.llm.optional | boolean | Optional means the component runs without the gateway. | |
spec.requires.services.logDestination | object | LogDestination declares that the component receives the platform's log forwarder over HTTPS inside the cluster. | |
spec.requires.services.logDestination.port | integer (int32) | yes | Port is the port that Service and its pods serve HTTPS on, the same number on both: it is the pods' port the network admits. |
spec.requires.services.logDestination.service | string | yes | Service is the name of the component's Service the forwarder is sent to. |
spec.requires.services.mail | object | Mail specifies SMTP and/or IMAP requirements. | |
spec.requires.services.mail.imap | object | IMAP requests inbound mail (IMAP) credentials. | |
spec.requires.services.mail.imap.tokenSignIn | boolean | TokenSignIn declares that the app opens a person's mailbox with that person's sign-in token (SASL XOAUTH2) instead of an app password. | |
spec.requires.services.mail.smtp | object | SMTP requests outbound mail (SMTP submission) credentials. | |
spec.requires.services.mcp | object | MCP declares that the component exposes a Model Context Protocol endpoint. | |
spec.requires.services.mcp.auth | string | Auth is the authentication method the endpoint expects. | |
spec.requires.services.mcp.enabled | boolean | yes | Enabled says the component exposes the endpoint. |
spec.requires.services.mcp.endpoint | string | Endpoint is the HTTP path where the app exposes its MCP server. | |
spec.requires.services.partners | object | Partners declares that the component calls apps of partner realms on a person's behalf, takes such calls, or commissions partners of other tenants. | |
spec.requires.services.partners.accept | boolean | Accept says the component takes partners' assertions, turning each into the linked local account by the JWT authorization grant, for every partner the tenant… | |
spec.requires.services.partners.call | []string | Call names the tenant's partners the component asks assertions towards (standard token exchange, scope partner-<name>): a person's token in, a token for the… | |
spec.requires.services.partners.commission | boolean | Commission says the component asks the director to add receiving partners to the tenants that name it, or to take them away. | |
spec.requires.services.partners.serviceAccount | string | ServiceAccount is the Kubernetes service account the component's pods run as; its token is the client's credential. | |
spec.requires.services.rights | object | Rights declares that the component asks the platform whether a person may use an app of its tenant, for a person who is not at a browser. | |
spec.requires.services.rights.audit | boolean | Audit lets the same key ask three more questions, for a person of the platform tenant: may they audit the cluster (cluster#can_audit), may they configure it… | |
spec.requires.services.storage | object | Storage specifies object storage (S3) and/or filesystem (WebDAV) requirements. | |
spec.requires.services.storage.files | object | Files requests WebDAV access to the tenant's file-storage service. | |
spec.requires.services.storage.files.capabilities | []string | Capabilities lists the required access capabilities. | |
spec.requires.services.storage.files.protocol | string | Protocol is the access protocol. | |
spec.requires.services.storage.s3 | object | S3 requests a per-tenant S3 bucket from the platform's object store. | |
spec.requires.services.storage.s3.objectLock | boolean | ObjectLock makes the bucket with S3 Object Lock, which cannot be switched off again, and lets the app read and set the bucket's default retention… | |
spec.requires.services.turn | object | TURN declares that the component's clients relay real-time media through the platform's TURN edge. | |
spec.requires.services.vouching | object | Vouching declares that the component obtains tokens of a person who is not at a browser, on the strength of that person's earlier consent: it signs a short… | |
spec.requires.services.vouching.director | []string | Director names what a token the component obtains for a person may do at the platform's own API, beside the apps: plans-read reads the cluster's plans, its… | |
spec.requires.services.vouching.keys | object | yes | Keys says where the component publishes the keys its statements are signed with, as a JWKS. |
spec.requires.services.vouching.keys.path | string | Path is where the JWKS is served. | |
spec.requires.services.vouching.keys.port | integer (int32) | yes | Port is the Service's port. |
spec.requires.services.vouching.keys.service | string | yes | Service is the name of the component's Service. |
spec.secrets | object | Secrets are values the platform generates and holds that have no external counterparty. | |
spec.secrets.derived | []object | Derived secrets are keys the platform adds to the credentials Secret it manages for the component, under the names given. | |
spec.secrets.derived[].key | string | yes | Key is the Secret key, and therefore the environment variable name when the app consumes the Secret with envFrom (e.g. |
spec.secrets.generated | []object | Generated secrets are random, created once and held in the vault. | |
spec.secrets.generated[].name | string | yes | Name is the logical identifier for this secret (e.g., "admin_password"). |
spec.secrets.generated[].valuePath | string | yes | ValuePath is the dot-notation (or bracket-notation) Helm value key that should receive the generated secret value. |
spec.secrets.supplied | []object | Supplied secrets are credentials only a person can provide. | |
spec.secrets.supplied[].description | string | Description says what the credential is for and where to obtain it, for a tenant administrator who did not write the profile. | |
spec.secrets.supplied[].displayName | string | yes | DisplayName is the label the form renders. |
spec.secrets.supplied[].fields | []object | yes | Fields are the values the form collects, set together. |
spec.secrets.supplied[].fields[].example | string | Example is a non-secret illustration of the expected shape. | |
spec.secrets.supplied[].fields[].format | string | Format hints at how the form renders and checks the field. | |
spec.secrets.supplied[].fields[].key | string | yes | Key is the property's name at the vault path and in the form. |
spec.secrets.supplied[].fields[].public | boolean | Public marks a value that is not secret -- a publishable key, an account id -- which the form then shows as typed. | |
spec.secrets.supplied[].fields[].valuePath | string | yes | ValuePath is the Helm value key that receives the value, as for a generated secret. |
spec.secrets.supplied[].name | string | yes | Name identifies the credential within the app: the last part of its vault path and of the requirement's name, app-{tenant}-{app}-{name}. |
spec.sessionMaxAge | string | SessionMaxAge caps, at the realm, how long a sign-in through the app's own OIDC clients lasts: the operator sets it as the clients' session lifespan, and past… | |
spec.trustTier | string | yes | TrustTier is the review level of this entry. |
spec.version | string | yes | Version is the catalog entry's version, not the upstream project's. |
status | object | ComponentProfileStatus is the observed state of a ComponentProfile. | |
status.conditions | []object | ||
status.conditions[].lastTransitionTime | string (date-time) | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer (int64) | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
status.conditions[].status | string | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.delivery | string | Delivery is read from the package: workload for a chart or a composition, api for a component the platform routes to, addon for one it does not deploy at all. |
9. CredentialRequirement
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | credentialrequirements |
| Short names | credreq |
CredentialRequirement declares a secret that must be supplied from outside the cluster: a registry token, a DNS provider key, an SMTP relay password. It is catalog data, not a provisioning API — a schema, a target path in OpenBao, and a validation hint. It is deliberately a plain CRD rather than a Crossplane XRD. It composes nothing: an XRD requires a Composition producing managed resources, and there are none to produce. It sits beside ComponentProfile as catalog. There is no controller. Each requirement emits an ExternalSecret, and ESO's sync status IS the satisfaction probe — path absent in OpenBao gives SecretSyncedError, path present gives Ready. That keeps satisfaction a Kubernetes condition (so Compositions can gate on it) and means no bespoke component has to hold an OpenBao token in order to poll. Naming: these are "credential requirements" or "credential inputs", never "external secrets". ESO's ExternalSecret is a reference to a secret stored externally, which is nearly the opposite of a secret that must be supplied from outside.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | CredentialRequirementSpec describes one credential an operator must supply. | |
spec.consumedBy | []object | ConsumedBy documents which resources depend on this credential. | |
spec.consumedBy[].kind | string | yes | Kind of the consuming resource, e.g. XRepository. |
spec.consumedBy[].name | string | yes | Name of the consuming resource. |
spec.description | string | Description explains what the credential is for and where to obtain it. | |
spec.displayName | string | yes | DisplayName is the label a form renders for this requirement. |
spec.fields | []object | yes | Fields enumerates the keys stored at VaultPath. |
spec.fields[].example | string | Example is a non-secret illustration of the expected shape. | |
spec.fields[].format | string | Format hints at how a form should render and check the field. | |
spec.fields[].key | string | yes | Key is the field name within the OpenBao secret. |
spec.fields[].minLength | integer | MinLength enforces a minimum, declared once here rather than hardcoded at each site that checks it. | |
spec.fields[].secret | boolean | Secret marks a field whose value must never be displayed or logged. | |
spec.optional | boolean | Optional marks an unsatisfied requirement as an informational gap rather than an error. | |
spec.phase | string | yes | Phase decides whether an unsatisfied requirement blocks installation. |
spec.scope | string | yes | Scope determines which OpenBao policy governs the write and who may see the requirement. |
spec.tenant | string | Tenant names the tenant a tenant-scoped requirement belongs to. | |
spec.validate | object | Validate is the probe run BEFORE the value is written, so a bad paste becomes a red field at install time rather than a stalled provisioning job hours later. | |
spec.validate.host | string | Host is the endpoint probed, when the validator needs one that is not derivable from the fields themselves. | |
spec.validate.type | string | yes | Type keys the validator. |
spec.validate.url | string | URL is the full endpoint probed, for validators that need a path. | |
spec.vaultPath | string | yes | VaultPath is the only coupling between this requirement and the storage layer. |
10. Customization
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Namespaced |
| Plural | customizations |
| Short names | cust, customizations |
Customization is a tracked, owned, dated deviation from an app as shipped.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | CustomizationSpec is the desired state of a Customization record. | |
spec.artifacts | []object | Artifacts point at the implementing code or content. | |
spec.artifacts[].path | string | Path is the repo-relative location of the artifact. | |
spec.artifacts[].repo | string | yes | Repo is the repository holding the artifact. |
spec.artifacts[].version | string | Version pins the artifact. | |
spec.created | string | Created is the date the record was written (RFC 3339 date). | |
spec.delivery | string | Delivery is how an L3 module reaches the running app. | |
spec.exitCriteria | string | ExitCriteria states what would allow this customization to be dropped. | |
spec.licensing | object | Licensing records the licensing effect. | |
spec.licensing.effect | string | Effect records whether licensing terms change. | |
spec.licensing.notes | string | Notes explains a non-none effect. | |
spec.origin | object | Origin records authorship and repository ownership. | |
spec.origin.authorship | string | Authorship records who wrote the customization. | |
spec.origin.contact | string | Contact is the maintainer contact for the customization. | |
spec.origin.organisation | string | Organisation names the authoring organization, when not Gentian. | |
spec.origin.repo | string | Repo is the backing repository, when externally owned. | |
spec.origin.repoOwnership | string | RepoOwnership records who controls that repository. | |
spec.origin.reviewedBy | string | ReviewedBy names the role at Gentian that accepted the customization. | |
spec.origin.supportContract | string | SupportContract records the support terms. | |
spec.owner | string | yes | Owner is the team or person accountable. |
spec.reviewBy | string | yes | ReviewBy is the date this deviation must be reconsidered. |
spec.rung | string | yes | Rung is the ladder rung this customization sits at. |
spec.rungJustification | map[string]string | RungJustification explains, per rung skipped, why nothing cheaper would do. | |
spec.scope | string | yes | Scope is the blast radius. |
spec.security | object | Security records the security posture. | |
spec.security.handlesPersonalData | boolean | HandlesPersonalData flags customizations that process personal data. | |
spec.security.macWaivers | []string | MACWaivers lists waivers this customization requires. | |
spec.security.newEgress | []string | NewEgress lists network destinations the customization introduces. | |
spec.summary | string | yes | Summary states what the customization does, in one line. |
spec.target | object | yes | Target identifies the app being customized. |
spec.target.appVersion | string | AppVersion is the upstream application version this was built against. | |
spec.target.chartVersion | string | ChartVersion is the chart version this was built against. | |
spec.target.family | string | Family is the logical app id shared across profile revisions. | |
spec.target.profile | string | yes | Profile is the ComponentProfile name this customization targets. |
spec.tenants | []string | Tenants lists affected tenants. | |
spec.testedAgainst | []string | TestedAgainst lists the app versions this customization was verified against. | |
spec.tests | []string | Tests lists the regression tests covering this customization. | |
spec.upgradeRisk | string | UpgradeRisk estimates the cost of the next upstream version bump. | |
spec.upstreamFirst | object | UpstreamFirst records the upstream-first obligation. | |
spec.upstreamFirst.appliedUpstream | boolean | AppliedUpstream reports whether upstream has accepted the change. | |
spec.upstreamFirst.attempted | boolean | Attempted reports whether upstream was searched and, where applicable, offered the change. | |
spec.upstreamFirst.forwarded | string | Forwarded mirrors DEP-3: was the change sent upstream? | |
spec.upstreamFirst.reason | string | Reason explains a Forwarded value of "no" or "not-needed". | |
spec.upstreamFirst.url | string | URL links the upstream issue or pull request. | |
status | object | CustomizationStatus is the observed state, computed by the operator. | |
status.conditions | []object | Conditions provide detailed status. | |
status.conditions[].lastTransitionTime | string (date-time) | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer (int64) | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
status.conditions[].status | string | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.observedGeneration | integer (int64) | ObservedGeneration is the last reconciled spec generation. | |
status.phase | string | Phase summarizes record health. | |
status.reviewOverdue | boolean | ReviewOverdue is true once spec.reviewBy has passed. | |
status.rungAboveRecommended | boolean | RungAboveRecommended is true when the target's customization surface offers a lower rung this record's rungJustification has no entry for — a rung the app has… | |
status.targetVersionDrift | boolean | TargetVersionDrift is true when the target profile now pins a chart or app version outside spec.testedAgainst. | |
status.upstreamStale | boolean | UpstreamStale is true when the change was never forwarded upstream and no reason was recorded, or when upstream has accepted it and the local delta is still… |
11. IntegrationBinding
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Namespaced |
| Plural | integrationbindings |
| Short names | ib, ibs |
IntegrationBinding is the Schema for the integrationbindings API. IntegrationBinding is namespace-scoped — it lives in the tenant's namespace and is auto-generated by the orchestrator when both the provider and consumer apps are present in a tenant's app list and their profiles declare compatible integration contracts. The binding provisions shared credentials in OpenBao and wires the authentication method between provider and consumer.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | IntegrationBindingSpec defines the desired state of an IntegrationBinding. | |
spec.auth | object | Auth configures how the consumer authenticates to the provider. | |
spec.auth.vaultPath | string | VaultPath is the OpenBao path where shared credentials are stored. | |
spec.capabilities | []string | Capabilities lists the specific contract capabilities being granted. | |
spec.consumer | object | yes | Consumer identifies the app that consumes the contract. |
spec.consumer.app | string | yes | App is the name of the app (corresponds to the ComponentProfile name). |
spec.consumer.namespace | string | yes | Namespace is the Kubernetes namespace where the app is running. |
spec.contract | string | yes | Contract is the name of the integration contract being fulfilled (e.g., "file-store", "filepicker", "central-navigation"). |
spec.endpoint | object | Endpoint is where the provider answers the contract, copied from its profile's spec.provides entry. | |
spec.endpoint.path | string | Path is appended to the address the consumer is told, for an API served below the root. | |
spec.endpoint.port | integer (int32) | yes | Port is the Service's port, and must be the port the provider's pods listen on: a network policy matches the port a pod listens on, and the way it opens is to… |
spec.endpoint.service | string | yes | Service is the provider's Service, in the namespace it is installed in. |
spec.provider | object | yes | Provider identifies the app that fulfils the contract. |
spec.provider.app | string | yes | App is the name of the app (corresponds to the ComponentProfile name). |
spec.provider.namespace | string | yes | Namespace is the Kubernetes namespace where the app is running. |
status | object | IntegrationBindingStatus holds the observed state of an IntegrationBinding. | |
status.conditions | []object | Conditions provides detailed status conditions. | |
status.conditions[].lastTransitionTime | string (date-time) | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer (int64) | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
status.conditions[].status | string | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.state | string | State summarizes whether the binding is functional. |
12. MailboxRemoval
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | mailboxremovals |
| Short names | mbxr |
MailboxRemoval records what whoever removed a person decided about that person's mailbox, and what became of it. The registrar writes it, when a person is removed from a tenant that keeps mailboxes on the cluster's own mail server; the operator carries it out, by a Job beside the mail server's volume, and reports here. For as long as the mailbox is archived this is also the record an administrator reads the archive from, and where its deletion is asked for.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | MailboxRemovalSpec is the decision. | |
spec.address | string | yes | Address is the address the removed person received mail at. |
spec.deleteArchive | object | DeleteArchive, once set, asks for the archived mailbox to be deleted, and says who asked. | |
spec.deleteArchive.at | string (date-time) | At is when they asked. | |
spec.deleteArchive.name | string | Name is how the person is shown: their address or name at the time. | |
spec.deleteArchive.requestID | string | RequestID joins this to the registrar's record of the authority and to the identity provider's own event. | |
spec.deleteArchive.subject | string | yes | Subject is the person's id at the identity provider. |
spec.mailbox | string | yes | Mailbox is the choice: archive or delete. |
spec.requestedBy | object | yes | RequestedBy is who removed the person and made the choice. |
spec.requestedBy.at | string (date-time) | At is when they asked. | |
spec.requestedBy.name | string | Name is how the person is shown: their address or name at the time. | |
spec.requestedBy.requestID | string | RequestID joins this to the registrar's record of the authority and to the identity provider's own event. | |
spec.requestedBy.subject | string | yes | Subject is the person's id at the identity provider. |
spec.restored | object | Restored says this record was not written at a removal: a restore wrote it, for an archived mailbox it put back from a backup, so that the archive is listed… | |
spec.restored.address | string | Address is the address the removed person received at, in the domain of the tenant restored into. | |
spec.restored.archive | string | yes | Archive is the archived mailbox's name in the domain's archive. |
spec.restored.archivedAt | string (date-time) | ArchivedAt is when it was archived, where the bundle was taken; By who chose that, as they were shown there. | |
spec.restored.by | string | ||
spec.restored.domain | string | Domain is the mail domain whose archive it is in. | |
spec.restored.messages | integer (int64) | ||
spec.restored.sizeBytes | integer (int64) | ||
spec.tenant | string | yes | Tenant is the tenant the person was removed from. |
status | object | MailboxRemovalStatus is what became of the mailbox. | |
status.archive | string | Archive is the archived mailbox's name in the domain's archive. | |
status.archivedAt | string (date-time) | ArchivedAt is when the mailbox was archived; DeletedAt when the mailbox, or later its archive, was deleted. | |
status.attempts | integer (int32) | Attempts counts the Jobs that failed, and LastFailureAt is when the last one did: the next is started later each time. | |
status.deletedAt | string (date-time) | ||
status.domain | string | Domain is the mail domain the mailbox was in. | |
status.lastFailureAt | string (date-time) | ||
status.message | string | Message says, in a sentence, what happened or what is waited for. | |
status.messages | integer (int64) | ||
status.phase | string | MailboxRemovalPhase is where a removed person's mailbox stands. | |
status.refused | boolean | Refused is set when the operator will not act on this record at all: the address is not one of the tenant's mailboxes, or still belongs to a person. | |
status.signInGoneAt | string (date-time) | SignInGoneAt is when the operator last saw that no mail password of the address is left with the mail server. | |
status.sizeBytes | integer (int64) | SizeBytes and Messages are what the mailbox held when it was archived or deleted. |
13. OIDCPackCatalog
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | oidcpackcatalogs |
| Short names | oidcpack, oidcpacks |
OIDCPackCatalog is a cluster-scoped catalog of OIDC packs for tenant apps. Shipped from gentian-apps (profiles/<app>/oidc-catalog.yaml) and consumed by the operator for pack Jobs and an app's client default scopes.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | OIDCPackCatalogSpec holds mapper templates and per-clientId pack definitions. | |
spec.mapperTemplates | map[string]object | MapperTemplates are reusable Keycloak protocol mapper definitions. | |
spec.mapperTemplates{}.config | map[string]string | Config holds Keycloak mapper configuration key/value pairs. | |
spec.mapperTemplates{}.keycloakName | string | KeycloakName overrides the mapper name in Keycloak when it differs from the catalog template key. | |
spec.mapperTemplates{}.protocolMapper | string | yes | ProtocolMapper is the Keycloak protocol mapper type. |
spec.packs | map[string]object | Packs maps OIDC clientId to pack configuration. | |
spec.packs{}.clientRole | string | ClientRole is the Keycloak client role mapped from the entitlement group. | |
spec.packs{}.defaultScopes | []string | DefaultScopes are realm default scopes attached before the pack scope. | |
spec.packs{}.entitlementGroup | string | EntitlementGroup is the Keycloak group name mapped to the pack client role. | |
spec.packs{}.fullScopeAllowed | boolean | FullScopeAllowed controls Keycloak fullScopeAllowed on the client. | |
spec.packs{}.mappers | []string | Mappers lists mapper template keys from spec.mapperTemplates. | |
spec.packs{}.publicClient | boolean | PublicClient marks the OIDC client as PUBLIC (PKCE, no secret). | |
spec.packs{}.scopeDescription | string | ScopeDescription is shown in the Keycloak admin UI. | |
spec.packs{}.scopeName | string | ScopeName is the Keycloak client scope created for this pack. | |
spec.packs{}.serviceClient | boolean | ServiceClient provisions a confidential client for a backend service rather than an application users log in to. | |
status | object | OIDCPackCatalogStatus is optional observed state. |
14. PlanOrdering
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | planorderings |
| Short names |
PlanOrdering is the cluster's notice on how to order another plan.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | yes | PlanOrderingSpec says where a tenant orders another resource plan. |
spec.email | string | Email is an address to write to. | |
spec.phone | string | Phone is a number to call, as it is dialed from abroad. | |
spec.text | map[string]string | yes | Text is the notice by language: a two-letter code, such as en or de, and what to show a person reading in it. |
spec.url | string | URL is where to order, opened in a new page. |
15. PlatformSecurityPolicy
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | platformsecuritypolicies |
| Short names | psp, platformsec |
PlatformSecurityPolicy is the cluster singleton where platform administrators approve MAC waivers and other cluster-wide security posture settings.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | PlatformSecurityPolicySpec holds cluster-admin security configuration. | |
spec.allowedClusterRoles | []object | AllowedClusterRoles lists, per profile, the platform's cluster roles this cluster permits. | |
spec.allowedClusterRoles[].profile | string | yes | Profile is the ComponentProfile metadata.name that may be bound to it. |
spec.allowedClusterRoles[].role | string | yes | Role is the platform's name of the role, as a profile asks for it in requires.privileges.clusterRoles[].name. |
spec.allowedMacWaivers | []object | AllowedMacWaivers lists profile/policy/scope tuples the cluster permits. | |
spec.allowedMacWaivers[].policy | string | yes | Policy is the Kyverno ClusterPolicy name. |
spec.allowedMacWaivers[].profile | string | yes | Profile is the ComponentProfile metadata.name that may use this waiver. |
spec.allowedMacWaivers[].scope | string | yes | Scope matches MacWaiverRequest.scope on the profile. |
status | object | PlatformSecurityPolicyStatus reports observed policy state. | |
status.allowedMacWaiverCount | integer | AllowedMacWaiverCount is len(spec.allowedMacWaivers) last written to the gentian-platform-security ConfigMap. | |
status.conditions | []object | Conditions provide reconciliation detail. | |
status.conditions[].lastTransitionTime | string (date-time) | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer (int64) | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
status.conditions[].status | string | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
16. ProfileBuild
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | profilebuilds |
| Short names | pb |
ProfileBuild is one build of a profile, as a catalog published it: the bundle at one digest, kept on the cluster for as long as a tenant runs it. A ComponentProfile is one object per name for the whole cluster, and it is the newest build any tenant installed. A tenant pinned to another build runs it from here: the operator reads its profile out of the bundle this object carries, verified against the digest, and a profile's own Composition reads the same spec from profileSpec. So two tenants on two builds of one app share nothing, and a tenant moved back to a build it ran before finds it without fetching anything. Written by the director beside the profile, into the catalog directory of the deployments repository, and applied from there by Argo CD; the installer writes the same file for the profile it places. Nothing edits it: a build is its digest. The operator reads the bundle, holds it to the digest and to what a bundle may hold, and writes the profile's spec it found onto the status, which is what a profile's own Composition reads.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | yes | ProfileBuildSpec is the build. |
spec.bundle | string | yes | Bundle is the published file, base64: the profile and its companions, the bytes that hash to Digest. |
spec.digest | string | yes | Digest is the sha256 of the bundle, "sha256:<hex>", as the catalog's index states it and as an install pins it. |
spec.origin | string | yes | Origin is which catalog the bundle was fetched from, as the director records it on the profile (cluster/<source> or tenant/<t>/<source>). |
spec.profile | string | yes | Profile is the name of the ComponentProfile this is a build of: the app's identity across every build. |
status | object | ProfileBuildStatus is what the operator found in the bundle. | |
status.conditions | []object | Conditions: Verified is True when the bundle is the digest it claims and holds what a bundle may; False names what was found. | |
status.conditions[].lastTransitionTime | string (date-time) | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer (int64) | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
status.conditions[].status | string | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.profileSpec | object | ProfileSpec is the bundle's profile spec, with the defaults the API server gives a ComponentProfile, written once the bundle verified. | |
status.profileSpec.adapter | object | Adapter is what an adapter adapts. | |
status.profileSpec.adapter.adapts | object | Adapts names the app whose interface this adapter uses: the app's ComponentProfile, which must be installed in the same tenant. | |
status.profileSpec.adapter.adapts.profile | string | yes | Profile is the ComponentProfile of the app. |
status.profileSpec.adapter.adapts.versions | []string | Versions are the catalog versions of the app this adapter was reviewed against. | |
status.profileSpec.backup | object | Backup declares what a consistent copy of this component consists of. | |
status.profileSpec.backup.boundSecrets | []object | BoundSecrets lists secrets this app's data is welded to: not derived, held outside the app's own captured data, and required to make sense of that data again. | |
status.profileSpec.backup.boundSecrets[].keys | []string | Keys selects individual keys at that path. | |
status.profileSpec.backup.boundSecrets[].openBaoPath | string | yes | OpenBaoPath is relative to this tenant's own prefix (gentian-os/tenants/{tenant}/), so a profile can only ever name secrets belonging to the tenant being… |
status.profileSpec.backup.quiesce | object | Quiesce controls how writes are paused while the app is captured. | |
status.profileSpec.backup.quiesce.container | string | Container names the container to run Pre and Post in. | |
status.profileSpec.backup.quiesce.mode | string | Mode selects how writes are paused. | |
status.profileSpec.backup.quiesce.post | []string | Post is the command that resumes writes. | |
status.profileSpec.backup.quiesce.pre | []string | Pre is the command that pauses writes, required when mode is command. | |
status.profileSpec.backup.restore | object | Restore declares what must run after this app's data is loaded and before it is resumed. | |
status.profileSpec.backup.restore.domainBound | boolean | DomainBound says the app's data cannot be moved to another domain: it names the tenant's domain in a way the app refuses to run with another (a server name… | |
status.profileSpec.backup.restore.post | [][]string | Post lists commands run in order once the app's data is loaded and before it is resumed — cache invalidation, re-indexing, fingerprinting, and rewriting what… | |
status.profileSpec.backup.restore.verify | []string | Verify is a single command that must exit zero before the restore is reported successful. | |
status.profileSpec.backup.volumes | object | Volumes narrows what is captured from the app's PersistentVolumeClaims. | |
status.profileSpec.backup.volumes.excludePaths | []string | ExcludePaths drops matching paths from the captured archive, as glob patterns relative to each volume root. | |
status.profileSpec.backup.volumes.include | []string | Include names the PersistentVolumeClaims to capture. | |
status.profileSpec.classes | []string | yes | Classes lists the modes this component may be deployed under. |
status.profileSpec.customization | object | Customization declares what a tenant may change about this component. | |
status.profileSpec.customization.addon | object | Addon declares that this profile is an addon rather than a deployable app, and how the base activates it. | |
status.profileSpec.customization.addon.id | string | yes | ID is what the hosting app's own addon system calls this addon: an Odoo module name, a Nextcloud app id, an XWiki extension. |
status.profileSpec.customization.addon.of | string | yes | Of is the ComponentProfile name of the base this addon activates into. |
status.profileSpec.customization.addonActivation | object | AddonActivation tells the platform how to turn a tenant's addon selection into Helm values for this base. | |
status.profileSpec.customization.addonActivation.script | string | yes | Script is written to ValuesPath with the token GENTIAN_ADDON_IDS replaced by the space-separated addon ids. |
status.profileSpec.customization.addonActivation.valuesPath | string | yes | ValuesPath is the dot-separated Helm values path the rendered Script is written to, e.g. "nextcloud.hooks.before-starting". |
status.profileSpec.customization.addonValues | []object | AddonValues overlays extra Helm values onto this app's release when a given addon is selected. | |
status.profileSpec.customization.addonValues[].values | object (free-form) | yes | Values are merged into the release values when that addon is selected, and omitted entirely when it is not. |
status.profileSpec.customization.addonValues[].whenAddon | string | yes | WhenAddon is the app-side addon id — the value of spec.customization.addon.id on the addon's profile, e.g. "richdocuments", not the profile name. |
status.profileSpec.customization.configure | object | Configure describes the L0 surface. | |
status.profileSpec.customization.configure.hotReload | boolean | HotReload reports whether a values change applies without a restart. | |
status.profileSpec.customization.configure.valuesSchema | string | ValuesSchema is the repo-relative path to the chart's values.schema.json. | |
status.profileSpec.customization.dropIns | []object | DropIns declares the L1 surface: directories the app treats as extension points. | |
status.profileSpec.customization.dropIns[].format | string | yes | Format is the content format expected in this directory. |
status.profileSpec.customization.dropIns[].maxBytes | integer (int32) | MaxBytes caps the total tenant-supplied content for this drop-in. | |
status.profileSpec.customization.dropIns[].name | string | yes | Name identifies the drop-in. |
status.profileSpec.customization.dropIns[].path | string | yes | Path is the absolute in-container directory the files are mounted at. |
status.profileSpec.customization.dropIns[].source | string | Source is the Kubernetes object the content is delivered through. | |
status.profileSpec.customization.dropIns[].tenantEditable | boolean | TenantEditable allows tenant admins to supply files here through Tenant.spec.apps[].config.dropIns. | |
status.profileSpec.customization.dropIns[].upstreamDocumented | boolean | UpstreamDocumented reports whether upstream documents this path as an extension point. | |
status.profileSpec.customization.extension | object | Extension describes the L3 surface: the app's own addon system. | |
status.profileSpec.customization.extension.addonPath | string | AddonPath is the in-container directory addons are loaded from (Odoo's custom-addons, Nextcloud's custom_apps). | |
status.profileSpec.customization.extension.apiDocs | string | APIDocs links to the extension API documentation. | |
status.profileSpec.customization.extension.apiStability | string | APIStability rates the extension API. | |
status.profileSpec.customization.extension.delivery | []string | Delivery lists the supported ways an addon reaches the running app. | |
status.profileSpec.customization.extension.mechanism | string | yes | Mechanism names the app's extension system (for example "odoo-addon", "nextcloud-app", "xwiki-extension"). |
status.profileSpec.customization.extension.perTenantAddons | boolean | PerTenantAddons reports whether tenants may have divergent addon sets. | |
status.profileSpec.customization.extension.registry | string | Registry is the repository or index addons are sourced from. | |
status.profileSpec.customization.extension.testMatrix | []string | TestMatrix lists the upstream app versions addons are tested against. | |
status.profileSpec.customization.fork | object | Fork describes the L6 surface: whether a fork is permitted, and who owns it. | |
status.profileSpec.customization.fork.allowed | boolean | Allowed gates whether a fork is a permitted outcome for this app. | |
status.profileSpec.customization.fork.cveWatch | boolean | CVEWatch reports whether the fork has active vulnerability monitoring. | |
status.profileSpec.customization.fork.owner | string | Owner is the team or organization accountable for the fork, including its CVE response. | |
status.profileSpec.customization.fork.repo | string | Repo is the Gentian-owned fork. | |
status.profileSpec.customization.fork.upstream | string | Upstream is the project the fork diverged from. | |
status.profileSpec.customization.grade | string | Grade rates customization readiness (see CustomizationGrade). | |
status.profileSpec.customization.ladderDocs | string | LadderDocs links to human documentation of this app's ladder. | |
status.profileSpec.customization.patch | object | Patch describes the L5 surface: whether a patch series is permitted. | |
status.profileSpec.customization.patch.allowed | boolean | Allowed gates whether a patch series may be carried for this app at all. | |
status.profileSpec.customization.patch.buildRepo | string | BuildRepo is the repository holding the pinned upstream and the series. | |
status.profileSpec.customization.patch.requiresApproval | string | RequiresApproval names the role that must approve a new patch. | |
status.profileSpec.customization.patch.seriesPath | string | SeriesPath is the repo-relative path to the quilt-style series file. | |
status.profileSpec.customization.publishes | object | Publishes describes what this app offers so that another app can be built at L2 against it. | |
status.profileSpec.customization.publishes.apis | []object | APIs lists the published interfaces a companion app can build against. | |
status.profileSpec.customization.publishes.apis[].auth | string | Auth is the authentication method companions must use. | |
status.profileSpec.customization.publishes.apis[].contract | string | yes | Contract is the Gentian contract name this API satisfies. |
status.profileSpec.customization.publishes.apis[].path | string | Path is the base path the API is served at. | |
status.profileSpec.customization.publishes.apis[].protocol | string | Protocol is the wire protocol (for example "http-json", "webdav", "matrix"). | |
status.profileSpec.customization.publishes.apis[].spec | string | Spec names the interface description format (for example "openapi", "graphql"). | |
status.profileSpec.customization.repackage | object | Repackage describes the L4 surface: who owns the packaging. | |
status.profileSpec.customization.repackage.chartOwnership | string | ChartOwnership records whether the chart is upstream's, Gentian-authored, or a vendored copy. | |
status.profileSpec.customization.repackage.compositionRef | string | CompositionRef names the profile-scoped Crossplane composition, when the app needs a custom managed-resource graph. | |
status.profileSpec.customization.rubricScore | integer (int32) | RubricScore is the §4.1 rubric total backing Grade (0-8). | |
status.profileSpec.customization.supportedRungs | []string | SupportedRungs lists the rungs at which this app can be customized. | |
status.profileSpec.defaultForPlatform | boolean | DefaultForPlatform is placement {tenants: platform}. | |
status.profileSpec.defaultForTenants | boolean | DefaultForTenants is placement {tenants: every}. | |
status.profileSpec.defaultWhereStoreOffered | boolean | DefaultWhereStoreOffered is placement {tenants: users, while: storeOffered}. | |
status.profileSpec.expose | []object | Expose declares entry points. | |
status.profileSpec.expose[].annotations | map[string]string | Annotations are gateway policy for this host. | |
status.profileSpec.expose[].apex | boolean | Apex publishes this entry on the cluster's bare domain -- its main address -- instead of a host under the zone's domain. | |
status.profileSpec.expose[].authMode | string | yes | AuthMode is mandatory and has no default. |
status.profileSpec.expose[].backend | object | yes | Backend is the Service the entry routes to. |
status.profileSpec.expose[].backend.component | string | Component names another component whose Service this entry routes to. | |
status.profileSpec.expose[].backend.port | integer (int32) | yes | |
status.profileSpec.expose[].backend.service | string | yes | |
status.profileSpec.expose[].clientAuthorization | string | ClientAuthorization says whose the Authorization header is on this entry. | |
status.profileSpec.expose[].denyPaths | []string | DenyPaths are refused even where Paths admits them. | |
status.profileSpec.expose[].exchangeToken | boolean | ExchangeToken asks the front door to hand this backend a token of the person that is valid at this app and nowhere else: the session's token exchanged at the… | |
status.profileSpec.expose[].forwardToken | boolean | ForwardToken asks the gateway to pass the edge access token to this backend. | |
status.profileSpec.expose[].name | string | yes | |
status.profileSpec.expose[].paths | []string | Paths this entry serves. | |
status.profileSpec.expose[].subDomain | string | SubDomain is the host label of this entry in the tenant's zone. | |
status.profileSpec.expose[].surface | string | yes | Surface selects where this entry is published. |
status.profileSpec.expose[].tile | object | Tile is how this entry appears on the portal, for an entry a person is meant to open. | |
status.profileSpec.expose[].tile.description | string | Description is the sentence the portal shows beside the label. | |
status.profileSpec.expose[].tile.displayName | string | yes | DisplayName is the label under the icon. |
status.profileSpec.expose[].tile.displayNames | map[string]string | DisplayNames are translations of DisplayName, keyed by locale ("de_DE", "en_US"). | |
status.profileSpec.expose[].tile.image | string | Image is the profile-relative path the PNG lives at in git, e.g. assets/tile.png. | |
status.profileSpec.expose[].tile.logo | string | yes | Logo is the tile's default image: a square PNG, 128x128, inline as a data URI. |
status.profileSpec.expose[].tile.object | string | Object is what Relation is checked against. | |
status.profileSpec.expose[].tile.path | string | Path is where within the host the tile leads. | |
status.profileSpec.expose[].tile.relation | string | yes | Relation is what the caller must hold, on the object Object names, for the tile to be on their page: a permission of the authorization model… |
status.profileSpec.extensions | []object | Extensions are containers shipped inside the component's own pod: the only escape hatch, and one that cannot create a cluster-scoped object. | |
status.profileSpec.extensions[].appSecrets | []object | AppSecrets are sidecar-internal secrets stored at gentian-os/tenants/{tenant}/apps/{parent}-{name}/internal/{secret}. | |
status.profileSpec.extensions[].appSecrets[].name | string | yes | Name is the logical identifier for this secret (e.g., "admin_password"). |
status.profileSpec.extensions[].appSecrets[].valuePath | string | yes | ValuePath is the dot-notation (or bracket-notation) Helm value key that should receive the generated secret value. |
status.profileSpec.extensions[].chart | object | yes | Chart references the sidecar Helm chart. |
status.profileSpec.extensions[].chart.name | string | yes | Name is the chart name within the repository. |
status.profileSpec.extensions[].chart.repository | string | yes | Repository is the OCI repository URL (e.g., oci://registry.example.com/charts). |
status.profileSpec.extensions[].chart.version | string | yes | Version is the chart version to deploy. |
status.profileSpec.extensions[].extraValues | object (free-form) | ExtraValues are merged into the sidecar Helm release values. | |
status.profileSpec.extensions[].kernelRequirements | object | ServiceRequirements declares kernel services the sidecar needs. | |
status.profileSpec.extensions[].kernelRequirements.authorization | object | Authorization declares that the component keeps its own relations in an authorization store the platform makes for it. | |
status.profileSpec.extensions[].kernelRequirements.authorization.groups | string | Groups "mirror" has the platform keep the tenant realm's group memberships in the store, as tuples group:<realm>/<group name>#member of… | |
status.profileSpec.extensions[].kernelRequirements.authorization.model | string | yes | Model is the store's authorization model in the OpenFGA DSL ("model / schema 1.1 / type user / ..."). |
status.profileSpec.extensions[].kernelRequirements.authorization.tuples | []object | Tuples are the store's starting tuples, written by the platform and held to the model when the profile is admitted. | |
status.profileSpec.extensions[].kernelRequirements.authorization.tuples[].object | string | yes | |
status.profileSpec.extensions[].kernelRequirements.authorization.tuples[].relation | string | yes | |
status.profileSpec.extensions[].kernelRequirements.authorization.tuples[].user | string | yes | |
status.profileSpec.extensions[].kernelRequirements.cache | object | Cache specifies a caching backend requirement. | |
status.profileSpec.extensions[].kernelRequirements.cache.engine | string | Engine selects the caching backend. | |
status.profileSpec.extensions[].kernelRequirements.database | object | Database specifies a relational database requirement. | |
status.profileSpec.extensions[].kernelRequirements.database.allowDynamicDatabaseCreation | boolean | AllowDynamicDatabaseCreation lets the app create databases of its own at runtime. | |
status.profileSpec.extensions[].kernelRequirements.database.connectionLimit | integer (int32) | ConnectionLimit is the most connections the app's account may hold at once on the shared server, which every tenant's apps use. | |
status.profileSpec.extensions[].kernelRequirements.database.engine | string | Engine selects the database engine. | |
status.profileSpec.extensions[].kernelRequirements.database.schemaPreference | string | SchemaPreference decides which schema the app's role resolves unqualified table names against first. | |
status.profileSpec.extensions[].kernelRequirements.identity | object | Identity specifies OIDC requirements. | |
status.profileSpec.extensions[].kernelRequirements.identity.oidc | object | OIDC describes the OIDC client to register in the tenant's Keycloak realm. | |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.accessType | string | AccessType controls whether the client requires a shared secret (CONFIDENTIAL, for server-side apps) or relies on PKCE without a secret (PUBLIC, for SPAs and… | |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.audiences | []string | Audiences are names the access tokens of this client carry in aud, beside what Keycloak puts there itself: the name a service the app hands its tokens to… | |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.backchannelLogout | object | BackchannelLogout says where in the app the realm tells it that a person signed out (OpenID Connect Back-Channel Logout). | |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.backchannelLogout.exposure | string | yes | Exposure names the entry of this profile (spec.expose) whose backend the path is served by. |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.backchannelLogout.path | string | yes | Path is the app's back-channel logout endpoint: a plain path. |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.backchannelLogoutUrl | string | BackchannelLogoutURL is withdrawn and refused: declare BackchannelLogout instead. | |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.clientId | string | yes | ClientID is the OIDC client identifier registered in Keycloak. |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.directAccessGrantsEnabled | boolean | DirectAccessGrantsEnabled enables the Resource Owner Password Credentials grant (legacy / CLI apps). | |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.name | string | Name is the human-readable display name shown in the Keycloak admin UI. | |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.oidcPackRef | string | OIDCPackRef selects a pack entry from an OIDCPackCatalog CR when the pack key differs from clientId. | |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.postLogoutRedirectUris | []string | PostLogoutRedirectURIs lists the allowed post-logout redirect URIs. | |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.redirectUris | []string | RedirectURIs lists the valid OAuth2 redirect URIs for the authorization code flow. | |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.requestParameter | object | RequestParameter binds an authorization-request parameter of this client's sign-ins to where the code is delivered, and puts it in the access token: for an… | |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.requestParameter.claim | string | Claim is the access-token claim the value is put in. | |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.requestParameter.name | string | yes | Name is the parameter, as the app sends it on the authorization request. |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.requestParameter.pattern | string | yes | Pattern is what the value must be, matched as a whole. |
status.profileSpec.extensions[].kernelRequirements.identity.oidc.requestParameter.redirectUri | string | yes | RedirectURI is the one address a code for the request is delivered to: https, with at least one ${group} for a named group of the pattern's match, and no… |
status.profileSpec.extensions[].kernelRequirements.identity.saml | object | SAML describes the SAML client to register in the tenant's Keycloak realm. | |
status.profileSpec.extensions[].kernelRequirements.identity.saml.acsUrl | string | yes | ACSURL is the SAML Assertion Consumer Service URL for the auth callback. |
status.profileSpec.extensions[].kernelRequirements.identity.saml.entityId | string | yes | EntityID is the SAML Service Provider Entity ID registered in Keycloak. |
status.profileSpec.extensions[].kernelRequirements.identity.sidecar | object | Sidecar signs people in through the platform's sign-in sidecar. | |
status.profileSpec.extensions[].kernelRequirements.identity.sidecar.appPort | integer (int32) | AppPort lets the handler call the app itself inside the cluster: it is the port the app's pods listen on, and the network path is opened to that port of the… | |
status.profileSpec.extensions[].kernelRequirements.identity.sidecar.database | boolean | Database gives the handler the app's own database: where it is and the app's own login to it, as DB_HOST, DB_PORT, DB_NAME, DB_USER and DB_PASSWORD, and the… | |
status.profileSpec.extensions[].kernelRequirements.identity.sidecar.entryPaths | []string | EntryPaths are paths of the app that lead to the sign-in instead of to the app: its front page, and the address of its own sign-in form. | |
status.profileSpec.extensions[].kernelRequirements.identity.sidecar.exposure | string | Exposure names the gateway entry people open the app at: the sidecar's two paths are on that entry's host. | |
status.profileSpec.extensions[].kernelRequirements.identity.sidecar.secrets | []string | Secrets gives the handler secrets of this app, by the names they have under spec.secrets.generated: each as SECRET_<NAME>, the name in upper case. | |
status.profileSpec.extensions[].kernelRequirements.llm | object | LLM declares that the component calls language models through the platform's model gateway. | |
status.profileSpec.extensions[].kernelRequirements.llm.optional | boolean | Optional means the component runs without the gateway. | |
status.profileSpec.extensions[].kernelRequirements.logDestination | object | LogDestination declares that the component receives the platform's log forwarder over HTTPS inside the cluster. | |
status.profileSpec.extensions[].kernelRequirements.logDestination.port | integer (int32) | yes | Port is the port that Service and its pods serve HTTPS on, the same number on both: it is the pods' port the network admits. |
status.profileSpec.extensions[].kernelRequirements.logDestination.service | string | yes | Service is the name of the component's Service the forwarder is sent to. |
status.profileSpec.extensions[].kernelRequirements.mail | object | Mail specifies SMTP and/or IMAP requirements. | |
status.profileSpec.extensions[].kernelRequirements.mail.imap | object | IMAP requests inbound mail (IMAP) credentials. | |
status.profileSpec.extensions[].kernelRequirements.mail.imap.tokenSignIn | boolean | TokenSignIn declares that the app opens a person's mailbox with that person's sign-in token (SASL XOAUTH2) instead of an app password. | |
status.profileSpec.extensions[].kernelRequirements.mail.smtp | object | SMTP requests outbound mail (SMTP submission) credentials. | |
status.profileSpec.extensions[].kernelRequirements.mcp | object | MCP declares that the component exposes a Model Context Protocol endpoint. | |
status.profileSpec.extensions[].kernelRequirements.mcp.auth | string | Auth is the authentication method the endpoint expects. | |
status.profileSpec.extensions[].kernelRequirements.mcp.enabled | boolean | yes | Enabled says the component exposes the endpoint. |
status.profileSpec.extensions[].kernelRequirements.mcp.endpoint | string | Endpoint is the HTTP path where the app exposes its MCP server. | |
status.profileSpec.extensions[].kernelRequirements.partners | object | Partners declares that the component calls apps of partner realms on a person's behalf, takes such calls, or commissions partners of other tenants. | |
status.profileSpec.extensions[].kernelRequirements.partners.accept | boolean | Accept says the component takes partners' assertions, turning each into the linked local account by the JWT authorization grant, for every partner the tenant… | |
status.profileSpec.extensions[].kernelRequirements.partners.call | []string | Call names the tenant's partners the component asks assertions towards (standard token exchange, scope partner-<name>): a person's token in, a token for the… | |
status.profileSpec.extensions[].kernelRequirements.partners.commission | boolean | Commission says the component asks the director to add receiving partners to the tenants that name it, or to take them away. | |
status.profileSpec.extensions[].kernelRequirements.partners.serviceAccount | string | ServiceAccount is the Kubernetes service account the component's pods run as; its token is the client's credential. | |
status.profileSpec.extensions[].kernelRequirements.rights | object | Rights declares that the component asks the platform whether a person may use an app of its tenant, for a person who is not at a browser. | |
status.profileSpec.extensions[].kernelRequirements.rights.audit | boolean | Audit lets the same key ask three more questions, for a person of the platform tenant: may they audit the cluster (cluster#can_audit), may they configure it… | |
status.profileSpec.extensions[].kernelRequirements.storage | object | Storage specifies object storage (S3) and/or filesystem (WebDAV) requirements. | |
status.profileSpec.extensions[].kernelRequirements.storage.files | object | Files requests WebDAV access to the tenant's file-storage service. | |
status.profileSpec.extensions[].kernelRequirements.storage.files.capabilities | []string | Capabilities lists the required access capabilities. | |
status.profileSpec.extensions[].kernelRequirements.storage.files.protocol | string | Protocol is the access protocol. | |
status.profileSpec.extensions[].kernelRequirements.storage.s3 | object | S3 requests a per-tenant S3 bucket from the platform's object store. | |
status.profileSpec.extensions[].kernelRequirements.storage.s3.objectLock | boolean | ObjectLock makes the bucket with S3 Object Lock, which cannot be switched off again, and lets the app read and set the bucket's default retention… | |
status.profileSpec.extensions[].kernelRequirements.turn | object | TURN declares that the component's clients relay real-time media through the platform's TURN edge. | |
status.profileSpec.extensions[].kernelRequirements.vouching | object | Vouching declares that the component obtains tokens of a person who is not at a browser, on the strength of that person's earlier consent: it signs a short… | |
status.profileSpec.extensions[].kernelRequirements.vouching.director | []string | Director names what a token the component obtains for a person may do at the platform's own API, beside the apps: plans-read reads the cluster's plans, its… | |
status.profileSpec.extensions[].kernelRequirements.vouching.keys | object | yes | Keys says where the component publishes the keys its statements are signed with, as a JWKS. |
status.profileSpec.extensions[].kernelRequirements.vouching.keys.path | string | Path is where the JWKS is served. | |
status.profileSpec.extensions[].kernelRequirements.vouching.keys.port | integer (int32) | yes | Port is the Service's port. |
status.profileSpec.extensions[].kernelRequirements.vouching.keys.service | string | yes | Service is the name of the component's Service. |
status.profileSpec.extensions[].name | string | yes | Name identifies the sidecar (e.g. |
status.profileSpec.extensions[].stableServiceName | string | StableServiceName is the Kubernetes Service name the tenant ingress reconciler routes to (e.g. | |
status.profileSpec.extensions[].stableServicePort | integer (int32) | StableServicePort is the port on StableServiceName. | |
status.profileSpec.extensions[].valueMapping | object | ValueMapping places what the platform granted the sidecar into its chart's values, as package.valueMapping does for the app. | |
status.profileSpec.extensions[].valueMapping.oidc | object | OIDC maps the sidecar's OIDC client to Helm keys, as the app's own valueMapping.oidc does. | |
status.profileSpec.extensions[].valueMapping.oidc.clientIdKey | string | ClientIDKey is the Helm value key for the OIDC client ID. | |
status.profileSpec.extensions[].valueMapping.oidc.clientSecretKey | string | ClientSecretKey is the Helm value key for the OIDC client secret. | |
status.profileSpec.extensions[].valueMapping.oidc.clientSecretOpenbaoPath | string | ClientSecretOpenbaoPath overrides the default per-tenant OpenBao secret path (gentian-os/tenants/{tenant}/apps/{app}/oidc) for reading the OIDC client secret. | |
status.profileSpec.extensions[].valueMapping.oidc.clientSecretOpenbaoProperty | string | ClientSecretOpenbaoProperty overrides the property name within the OpenBao secret (default: "client-secret"). | |
status.profileSpec.extensions[].valueMapping.oidc.issuerKey | string | IssuerKey is the Helm value key for the OIDC issuer URL. | |
status.profileSpec.hooks | object | Hooks are lifecycle actions at install, upgrade and resync. | |
status.profileSpec.hooks.postInstall | object | PostInstall runs once after the component is first ready. | |
status.profileSpec.hooks.postInstall.envFrom | []string | EnvFrom names Secrets already present in the tenant namespace to inject wholesale (matches how this app's own secrets already land — e.g.… | |
status.profileSpec.hooks.postInstall.image | string | yes | Image is the container image the Job runs. |
status.profileSpec.hooks.postInstall.readOnlyPVC | object | ReadOnlyPVC optionally mounts an existing PersistentVolumeClaim read-only, for the rare case a bootstrap script needs information only available in the app's… | |
status.profileSpec.hooks.postInstall.readOnlyPVC.claimName | string | yes | ClaimName is the PersistentVolumeClaim name in the tenant namespace. |
status.profileSpec.hooks.postInstall.readOnlyPVC.mountPath | string | yes | MountPath is where the claim is mounted read-only in the Job container. |
status.profileSpec.hooks.postInstall.script | string | yes | Script is the shell script body, run via /bin/sh -c. |
status.profileSpec.hooks.postInstall.serviceAccountName | string | ServiceAccountName runs the Job under an existing ServiceAccount in the tenant namespace (e.g. | |
status.profileSpec.hooks.provisioning | object | Provisioning configures the component through its own API after install and on resync. | |
status.profileSpec.hooks.provisioning.privilegedRole | object | PrivilegedRole maps gentian:tenant:<t>:app-admins members to an in-app administrator role (for example the Nextcloud "admin" group). | |
status.profileSpec.hooks.provisioning.privilegedRole.kind | string | yes | Kind is the application's native role type. |
status.profileSpec.hooks.provisioning.privilegedRole.name | string | yes | Name is the in-app role identifier (for example Nextcloud group "admin"). |
status.profileSpec.hooks.provisioning.syncJob | object | SyncJob is how this app applies PrivilegedRole. | |
status.profileSpec.hooks.provisioning.syncJob.env | []object | Env binds individual Secret keys to environment variables. | |
status.profileSpec.hooks.provisioning.syncJob.env[].name | string | yes | Name of the environment variable. |
status.profileSpec.hooks.provisioning.syncJob.env[].secretKeyRef | object | yes | SecretKeyRef is the Secret key to read it from. |
status.profileSpec.hooks.provisioning.syncJob.env[].secretKeyRef.key | string | yes | |
status.profileSpec.hooks.provisioning.syncJob.env[].secretKeyRef.name | string | yes | |
status.profileSpec.hooks.provisioning.syncJob.envFrom | []string | EnvFrom names Secrets in the tenant namespace whose keys become environment variables. | |
status.profileSpec.hooks.provisioning.syncJob.image | string | yes | Image the script runs in. |
status.profileSpec.hooks.provisioning.syncJob.script | string | yes | Script executed with /bin/sh. |
status.profileSpec.hooks.provisioning.syncJob.serviceAccountName | string | ServiceAccountName runs the Job under an existing ServiceAccount. | |
status.profileSpec.integrations | []object | Integrations are opportunistic relationships with peer components. | |
status.profileSpec.integrations[].capabilities | []string | Capabilities lists the specific capabilities required from the contract. | |
status.profileSpec.integrations[].contract | string | yes | Contract is the name of the contract to consume. |
status.profileSpec.integrations[].provider | string | Provider is the expected provider app by profile name. | |
status.profileSpec.launch | string | yes | Launch is how a person reaches this component. |
status.profileSpec.package | object | yes | Package is how the component is deployed. |
status.profileSpec.package.addon | object | Addon describes a component the platform does not deploy at all: it flips a switch inside another component's own addon system. | |
status.profileSpec.package.addon.id | string | yes | ID is what the hosting component's own addon system calls this addon: an Odoo module name, a Nextcloud app id, an XWiki extension. |
status.profileSpec.package.addon.of | string | yes | Of is the ComponentProfile this addon activates into. |
status.profileSpec.package.api | object | API describes a component the platform routes to rather than runs. | |
status.profileSpec.package.api.baseUrl | string | yes | BaseURL is the external service origin (e.g. |
status.profileSpec.package.api.runtime | string | Runtime selects how the tenant reaches the external service. | |
status.profileSpec.package.api.tenantBinding | string | TenantBinding declares how the tenant is identified to the external service. | |
status.profileSpec.package.api.tile | object | Tile puts this entry on the desktop of whoever holds its relation. | |
status.profileSpec.package.api.tile.description | string | Description is the sentence the portal shows beside the label. | |
status.profileSpec.package.api.tile.displayName | string | yes | DisplayName is the label under the icon. |
status.profileSpec.package.api.tile.displayNames | map[string]string | DisplayNames are translations of DisplayName, keyed by locale ("de_DE", "en_US"). | |
status.profileSpec.package.api.tile.image | string | Image is the profile-relative path the PNG lives at in git, e.g. assets/tile.png. | |
status.profileSpec.package.api.tile.logo | string | yes | Logo is the tile's default image: a square PNG, 128x128, inline as a data URI. |
status.profileSpec.package.api.tile.object | string | Object is what Relation is checked against. | |
status.profileSpec.package.api.tile.path | string | Path is where within the host the tile leads. | |
status.profileSpec.package.api.tile.relation | string | yes | Relation is what the caller must hold, on the object Object names, for the tile to be on their page: a permission of the authorization model… |
status.profileSpec.package.chart | object | Chart is the Helm chart or OCI artifact. | |
status.profileSpec.package.chart.name | string | yes | Name is the chart name within the repository. |
status.profileSpec.package.chart.repository | string | yes | Repository is the OCI repository URL (e.g., oci://registry.example.com/charts). |
status.profileSpec.package.chart.version | string | yes | Version is the chart version to deploy. |
status.profileSpec.package.composition | string | Composition names a Crossplane composition, for a component that is not a single chart. | |
status.profileSpec.package.extraValues | object (free-form) | ExtraValues are static chart values. | |
status.profileSpec.package.images | []object | Images are the private images the component runs, each at the one build it may run. | |
status.profileSpec.package.images[].digest | string | yes | Digest is the build. |
status.profileSpec.package.images[].repository | string | yes | Repository is the image's address without a tag. |
status.profileSpec.package.valueMapping | object | ValueMapping places what the platform granted into the chart's values. | |
status.profileSpec.package.valueMapping.cache | object | Cache maps caching backend values to Helm keys. | |
status.profileSpec.package.valueMapping.cache.hostKey | string | HostKey is the Helm value key for the cache host. | |
status.profileSpec.package.valueMapping.cache.passwordKey | string | PasswordKey is the Helm value key for the cache password/ACL token. | |
status.profileSpec.package.valueMapping.cache.portKey | string | PortKey is the Helm value key for the cache port. | |
status.profileSpec.package.valueMapping.cache.userKey | string | UserKey is the Helm value key for the cache ACL username. | |
status.profileSpec.package.valueMapping.database | object | Database maps database connection values to Helm keys. | |
status.profileSpec.package.valueMapping.database.hostKey | string | ||
status.profileSpec.package.valueMapping.database.nameKey | string | NameKey is the Helm value key for the database name. | |
status.profileSpec.package.valueMapping.database.passwordKey | string | PasswordKey is the Helm value key for the database password. | |
status.profileSpec.package.valueMapping.database.portKey | string | PortKey is the Helm value key for the database port. | |
status.profileSpec.package.valueMapping.database.readNameKey | string | ReadNameKey is the Helm value key for the read-replica database name. | |
status.profileSpec.package.valueMapping.database.readUserKey | string | ReadUserKey is the Helm value key for the read-replica database user. | |
status.profileSpec.package.valueMapping.database.secretNameKey | string | HostKey is the Helm value key for the database host. | |
status.profileSpec.package.valueMapping.database.userKey | string | UserKey is the Helm value key for the database user. | |
status.profileSpec.package.valueMapping.imap | object | IMAP maps mail access values to Helm keys. | |
status.profileSpec.package.valueMapping.imap.hostKey | string | HostKey is the Helm value key for the IMAP host. | |
status.profileSpec.package.valueMapping.imap.portKey | string | PortKey is the Helm value key for the IMAP port. | |
status.profileSpec.package.valueMapping.integrations | map[string]object | Integrations maps optional integration credentials to Helm keys, keyed by the contract name. | |
status.profileSpec.package.valueMapping.integrations{}.endpointKey | string | EndpointKey is the Helm value key for the integration's service endpoint URL. | |
status.profileSpec.package.valueMapping.integrations{}.passwordKey | string | PasswordKey is the Helm value key for the integration password. | |
status.profileSpec.package.valueMapping.integrations{}.userKey | string | UserKey is the Helm value key for the integration username. | |
status.profileSpec.package.valueMapping.llm | object | LLM maps the model gateway's address and the component's key to Helm keys, for a component that declares requires.services.llm. | |
status.profileSpec.package.valueMapping.llm.apiKeyKey | string | APIKeyKey is the Helm value key for the key the component presents. | |
status.profileSpec.package.valueMapping.llm.availableKey | string | AvailableKey receives true when the gateway's address and the component's key are delivered, and false while an optional requirement… | |
status.profileSpec.package.valueMapping.llm.baseUrlKey | string | BaseURLKey is the Helm value key for the gateway's OpenAI-compatible base address (it ends in /v1). | |
status.profileSpec.package.valueMapping.llm.secretNameKey | string | SecretNameKey receives the NAME of the Secret the component's model credentials are in (llm-credentials-<component>, in the component's namespace; the key is… | |
status.profileSpec.package.valueMapping.oidc | object | OIDC maps OIDC provider values to Helm keys. | |
status.profileSpec.package.valueMapping.oidc.clientIdKey | string | ClientIDKey is the Helm value key for the OIDC client ID. | |
status.profileSpec.package.valueMapping.oidc.clientSecretKey | string | ClientSecretKey is the Helm value key for the OIDC client secret. | |
status.profileSpec.package.valueMapping.oidc.clientSecretOpenbaoPath | string | ClientSecretOpenbaoPath overrides the default per-tenant OpenBao secret path (gentian-os/tenants/{tenant}/apps/{app}/oidc) for reading the OIDC client secret. | |
status.profileSpec.package.valueMapping.oidc.clientSecretOpenbaoProperty | string | ClientSecretOpenbaoProperty overrides the property name within the OpenBao secret (default: "client-secret"). | |
status.profileSpec.package.valueMapping.oidc.issuerKey | string | IssuerKey is the Helm value key for the OIDC issuer URL. | |
status.profileSpec.package.valueMapping.platform | object | Platform maps the facts of the cluster a component runs in to Helm keys: which zone it is served in, which realm signs that zone's tokens, where the director… | |
status.profileSpec.package.valueMapping.platform.audienceKey | string | AudienceKey receives the audience the forwarded edge token carries, so a backend can require it rather than accept any token the realm signs. | |
status.profileSpec.package.valueMapping.platform.clusterKey | string | ClusterKey receives the id the director knows this cluster by. | |
status.profileSpec.package.valueMapping.platform.countryKey | string | CountryKey receives the tenant's country (spec.country), an ISO 3166-1 alpha-2 code in upper case, and the empty string while the tenant names none. | |
status.profileSpec.package.valueMapping.platform.custodianUrlKey | string | CustodianURLKey receives the custodian's in-cluster URL. | |
status.profileSpec.package.valueMapping.platform.defaultLanguageKey | string | DefaultLanguageKey receives the tenant's own language, as an ISO 639-1 code (AD-15). | |
status.profileSpec.package.valueMapping.platform.desktopUrlKey | string | DesktopURLKey receives the in-cluster address of the API of the desktop in the component's own namespace, from the desktop profile's "api" entry: http://<its… | |
status.profileSpec.package.valueMapping.platform.directorUrlKey | string | DirectorURLKey receives the director's in-cluster URL. | |
status.profileSpec.package.valueMapping.platform.hostKey | string | HostKey receives the host this component answers on in its zone: the host of its first gateway entry, as the operator routes it. | |
status.profileSpec.package.valueMapping.platform.issuerKey | string | IssuerKey receives the zone's OIDC issuer, the realm on the identity provider whose tokens the edge forwards. | |
status.profileSpec.package.valueMapping.platform.kernelDomainKey | string | KernelDomainKey receives the cluster's kernel domain. | |
status.profileSpec.package.valueMapping.platform.organizationKey | string | OrganizationKey receives who the tenant is, as one object: displayName, legalName, country, languages (the first is the tenant's own), currency, timeZone… | |
status.profileSpec.package.valueMapping.platform.realmKey | string | RealmKey receives the name of the zone's realm. | |
status.profileSpec.package.valueMapping.platform.registrarUrlKey | string | RegistrarURLKey receives the registrar's in-cluster URL: where a console relays, with the person's own token, the managing of a tenant's people and groups. | |
status.profileSpec.package.valueMapping.platform.storeUrlKey | string | StoreURLKey receives the base address of the App Store API this cluster names (the Cluster claim's spec.catalogue.storeUrl), and the empty string while the… | |
status.profileSpec.package.valueMapping.platform.tenantKey | string | TenantKey receives the name of the tenant the component runs in. | |
status.profileSpec.package.valueMapping.platform.tenantUIDKey | string | TenantUIDKey receives the tenant's unique id, its metadata.uid: the id the usage statistics report names it by, and the one the store keys its sign-in through… | |
status.profileSpec.package.valueMapping.platform.timeZoneKey | string | TimeZoneKey receives the tenant's time zone (spec.organization.timeZone), an IANA name, for a chart that takes only the zone, such as a TZ variable. | |
status.profileSpec.package.valueMapping.platform.usherUrlKey | string | UsherURLKey receives the usher's in-cluster URL: where a desktop asks, with the person's own token, what that person may open. | |
status.profileSpec.package.valueMapping.platform.zoneClientIdKey | string | ZoneClientIDKey receives the client id the edge holds the zone's session with. | |
status.profileSpec.package.valueMapping.platform.zoneKindKey | string | ZoneKindKey receives "kernel" for a component served in the kernel zone and "tenant" otherwise. | |
status.profileSpec.package.valueMapping.s3 | object | S3 maps object storage values to Helm keys. | |
status.profileSpec.package.valueMapping.s3.accessKeyKey | string | AccessKeyKey is the Helm value key for the S3 access key ID. | |
status.profileSpec.package.valueMapping.s3.bucketKey | string | BucketKey is the Helm value key for the bucket name. | |
status.profileSpec.package.valueMapping.s3.endpointKey | string | EndpointKey is the Helm value key for the S3 endpoint URL. | |
status.profileSpec.package.valueMapping.s3.regionKey | string | RegionKey is the Helm value key for the S3 region. | |
status.profileSpec.package.valueMapping.s3.secretKeyKey | string | SecretKeyKey is the Helm value key for the S3 secret access key. | |
status.profileSpec.package.valueMapping.smtp | object | SMTP maps mail submission values to Helm keys. | |
status.profileSpec.package.valueMapping.smtp.hostKey | string | HostKey is the Helm value key for the SMTP host. | |
status.profileSpec.package.valueMapping.smtp.passwordKey | string | PasswordKey is the Helm value key for the SMTP password. | |
status.profileSpec.package.valueMapping.smtp.portKey | string | PortKey is the Helm value key for the SMTP port. | |
status.profileSpec.package.valueMapping.smtp.userKey | string | UserKey is the Helm value key for the SMTP username. | |
status.profileSpec.package.valueMapping.volumes | object | Volumes names where this chart takes extra pod volumes and mounts, for charts that do not use the conventional extraVolumes/extraVolumeMounts. | |
status.profileSpec.package.valueMapping.volumes.volumeMountsPath | string | VolumeMountsPath is the dot-separated values path holding a list of container volume mounts (e.g. | |
status.profileSpec.package.valueMapping.volumes.volumesPath | string | VolumesPath is the dot-separated values path holding a list of pod volumes (e.g. | |
status.profileSpec.placement | object | Placement makes this a component the platform places, and says where. | |
status.profileSpec.placement.tenants | string | yes | Tenants are the tenants that get the component. |
status.profileSpec.placement.while | string | While names the condition the placement lasts for; absent, it lasts for the life of each tenant. | |
status.profileSpec.provides | []object | Provides lists the contracts this component supplies. | |
status.profileSpec.provides[].endpoint | object | Endpoint is where this component answers the contract in the tenant's namespace. | |
status.profileSpec.provides[].endpoint.path | string | Path is appended to the address the consumer is told, for an API served below the root. | |
status.profileSpec.provides[].endpoint.port | integer (int32) | yes | Port is the Service's port, and must be the port the provider's pods listen on: a network policy matches the port a pod listens on, and the way it opens is to… |
status.profileSpec.provides[].endpoint.service | string | yes | Service is the provider's Service, in the namespace it is installed in. |
status.profileSpec.provides[].name | string | yes | Name is the contract name (e.g., "file-store", "project-management"). |
status.profileSpec.provides[].protocol | string | Protocol is the technical protocol used (e.g., "http-json", "webdav"). | |
status.profileSpec.requires | object | Requires is what the platform is obliged to provide before this component may run. | |
status.profileSpec.requires.platform | string | Platform is the oldest platform version line this build runs on, as a floor: ">=0.5", or "0.5" which means the same. | |
status.profileSpec.requires.privileges | object | Privileges escape the default posture. | |
status.profileSpec.requires.privileges.apiExtensions | []object | APIExtensions are resource types the component adds to the cluster's API. | |
status.profileSpec.requires.privileges.apiExtensions[].definitions | []object (free-form) | yes | Definitions are the CustomResourceDefinitions, apiextensions.k8s.io/v1, as they are installed. |
status.profileSpec.requires.privileges.apiExtensions[].group | string | yes | Group is the API group every definition is in: the add-on's own, never one of Kubernetes' or the platform's. |
status.profileSpec.requires.privileges.apiExtensions[].name | string | yes | Name is what a PrivilegeGrant refers to (apiExtensions/<name>). |
status.profileSpec.requires.privileges.apiExtensions[].reason | string | yes | Reason is what the approver reads. |
status.profileSpec.requires.privileges.apiExtensions[].serviceAccount | string | yes | ServiceAccount is the account the component's chart runs its pods under, in the component's namespace: the one that reads the types and writes their status. |
status.profileSpec.requires.privileges.clusterRoles | []object | ClusterRoles the component's ServiceAccount needs. | |
status.profileSpec.requires.privileges.clusterRoles[].name | string | yes | Name is the platform's name of the role, and what a PrivilegeGrant refers to (clusterRoles/<name>). |
status.profileSpec.requires.privileges.clusterRoles[].reason | string | yes | Reason is what the approver reads. |
status.profileSpec.requires.privileges.clusterRoles[].rules | []object | Rules is not used. | |
status.profileSpec.requires.privileges.clusterRoles[].rules[].apiGroups | []string | APIGroups is the name of the APIGroup that contains the resources. | |
status.profileSpec.requires.privileges.clusterRoles[].rules[].nonResourceURLs | []string | NonResourceURLs is a set of partial urls that a user should have access to. | |
status.profileSpec.requires.privileges.clusterRoles[].rules[].resourceNames | []string | ResourceNames is an optional white list of names that the rule applies to. | |
status.profileSpec.requires.privileges.clusterRoles[].rules[].resources | []string | Resources is a list of resources this rule applies to. | |
status.profileSpec.requires.privileges.clusterRoles[].rules[].verbs | []string | yes | Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. |
status.profileSpec.requires.privileges.clusterRoles[].serviceAccount | string | ServiceAccount is the ServiceAccount the component's chart runs its pods under, in the component's namespace. | |
status.profileSpec.requires.privileges.egress | []object | Egress opens outbound network beyond the tenant baseline. | |
status.profileSpec.requires.privileges.egress[].name | string | yes | Name is what a PrivilegeGrant refers to. |
status.profileSpec.requires.privileges.egress[].reason | string | yes | Reason is what the approver reads. |
status.profileSpec.requires.privileges.egress[].rule | object | yes | Rule is the egress to allow. |
status.profileSpec.requires.privileges.egress[].rule.ports | []object | ports is a list of destination ports for outgoing traffic. | |
status.profileSpec.requires.privileges.egress[].rule.ports[].endPort | integer (int32) | endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. | |
status.profileSpec.requires.privileges.egress[].rule.ports[].port | int-or-string | port represents the port on the given protocol. | |
status.profileSpec.requires.privileges.egress[].rule.ports[].protocol | string | protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. | |
status.profileSpec.requires.privileges.egress[].rule.to | []object | to is a list of destinations for outgoing traffic of pods selected for this rule. | |
status.profileSpec.requires.privileges.egress[].rule.to[].ipBlock | object | ipBlock defines policy on a particular IPBlock. | |
status.profileSpec.requires.privileges.egress[].rule.to[].ipBlock.cidr | string | yes | cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" |
status.profileSpec.requires.privileges.egress[].rule.to[].ipBlock.except | []string | except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected… | |
status.profileSpec.requires.privileges.egress[].rule.to[].namespaceSelector | object | namespaceSelector selects namespaces using cluster-scoped labels. | |
status.profileSpec.requires.privileges.egress[].rule.to[].namespaceSelector.matchExpressions | []object | matchExpressions is a list of label selector requirements. | |
status.profileSpec.requires.privileges.egress[].rule.to[].namespaceSelector.matchExpressions[].key | string | yes | key is the label key that the selector applies to. |
status.profileSpec.requires.privileges.egress[].rule.to[].namespaceSelector.matchExpressions[].operator | string | yes | operator represents a key's relationship to a set of values. |
status.profileSpec.requires.privileges.egress[].rule.to[].namespaceSelector.matchExpressions[].values | []string | values is an array of string values. | |
status.profileSpec.requires.privileges.egress[].rule.to[].namespaceSelector.matchLabels | map[string]string | matchLabels is a map of {key,value} pairs. | |
status.profileSpec.requires.privileges.egress[].rule.to[].podSelector | object | podSelector is a label selector which selects pods. | |
status.profileSpec.requires.privileges.egress[].rule.to[].podSelector.matchExpressions | []object | matchExpressions is a list of label selector requirements. | |
status.profileSpec.requires.privileges.egress[].rule.to[].podSelector.matchExpressions[].key | string | yes | key is the label key that the selector applies to. |
status.profileSpec.requires.privileges.egress[].rule.to[].podSelector.matchExpressions[].operator | string | yes | operator represents a key's relationship to a set of values. |
status.profileSpec.requires.privileges.egress[].rule.to[].podSelector.matchExpressions[].values | []string | values is an array of string values. | |
status.profileSpec.requires.privileges.egress[].rule.to[].podSelector.matchLabels | map[string]string | matchLabels is a map of {key,value} pairs. | |
status.profileSpec.requires.privileges.podSecurity | []object | PodSecurity waives a named admission policy for a named part of the component. | |
status.profileSpec.requires.privileges.podSecurity[].name | string | yes | Name is what a PrivilegeGrant refers to. |
status.profileSpec.requires.privileges.podSecurity[].policy | string | yes | Policy is the ClusterPolicy this waives. |
status.profileSpec.requires.privileges.podSecurity[].reason | string | yes | Reason is what the approver reads. |
status.profileSpec.requires.privileges.podSecurity[].scope | string | yes | Scope is the container or composition part it is waived for. |
status.profileSpec.requires.services | object | Services are what the platform must fulfill before this component runs: identity, database, object storage, cache, mail, MCP. | |
status.profileSpec.requires.services.authorization | object | Authorization declares that the component keeps its own relations in an authorization store the platform makes for it. | |
status.profileSpec.requires.services.authorization.groups | string | Groups "mirror" has the platform keep the tenant realm's group memberships in the store, as tuples group:<realm>/<group name>#member of… | |
status.profileSpec.requires.services.authorization.model | string | yes | Model is the store's authorization model in the OpenFGA DSL ("model / schema 1.1 / type user / ..."). |
status.profileSpec.requires.services.authorization.tuples | []object | Tuples are the store's starting tuples, written by the platform and held to the model when the profile is admitted. | |
status.profileSpec.requires.services.authorization.tuples[].object | string | yes | |
status.profileSpec.requires.services.authorization.tuples[].relation | string | yes | |
status.profileSpec.requires.services.authorization.tuples[].user | string | yes | |
status.profileSpec.requires.services.cache | object | Cache specifies a caching backend requirement. | |
status.profileSpec.requires.services.cache.engine | string | Engine selects the caching backend. | |
status.profileSpec.requires.services.database | object | Database specifies a relational database requirement. | |
status.profileSpec.requires.services.database.allowDynamicDatabaseCreation | boolean | AllowDynamicDatabaseCreation lets the app create databases of its own at runtime. | |
status.profileSpec.requires.services.database.connectionLimit | integer (int32) | ConnectionLimit is the most connections the app's account may hold at once on the shared server, which every tenant's apps use. | |
status.profileSpec.requires.services.database.engine | string | Engine selects the database engine. | |
status.profileSpec.requires.services.database.schemaPreference | string | SchemaPreference decides which schema the app's role resolves unqualified table names against first. | |
status.profileSpec.requires.services.identity | object | Identity specifies OIDC requirements. | |
status.profileSpec.requires.services.identity.oidc | object | OIDC describes the OIDC client to register in the tenant's Keycloak realm. | |
status.profileSpec.requires.services.identity.oidc.accessType | string | AccessType controls whether the client requires a shared secret (CONFIDENTIAL, for server-side apps) or relies on PKCE without a secret (PUBLIC, for SPAs and… | |
status.profileSpec.requires.services.identity.oidc.audiences | []string | Audiences are names the access tokens of this client carry in aud, beside what Keycloak puts there itself: the name a service the app hands its tokens to… | |
status.profileSpec.requires.services.identity.oidc.backchannelLogout | object | BackchannelLogout says where in the app the realm tells it that a person signed out (OpenID Connect Back-Channel Logout). | |
status.profileSpec.requires.services.identity.oidc.backchannelLogout.exposure | string | yes | Exposure names the entry of this profile (spec.expose) whose backend the path is served by. |
status.profileSpec.requires.services.identity.oidc.backchannelLogout.path | string | yes | Path is the app's back-channel logout endpoint: a plain path. |
status.profileSpec.requires.services.identity.oidc.backchannelLogoutUrl | string | BackchannelLogoutURL is withdrawn and refused: declare BackchannelLogout instead. | |
status.profileSpec.requires.services.identity.oidc.clientId | string | yes | ClientID is the OIDC client identifier registered in Keycloak. |
status.profileSpec.requires.services.identity.oidc.directAccessGrantsEnabled | boolean | DirectAccessGrantsEnabled enables the Resource Owner Password Credentials grant (legacy / CLI apps). | |
status.profileSpec.requires.services.identity.oidc.name | string | Name is the human-readable display name shown in the Keycloak admin UI. | |
status.profileSpec.requires.services.identity.oidc.oidcPackRef | string | OIDCPackRef selects a pack entry from an OIDCPackCatalog CR when the pack key differs from clientId. | |
status.profileSpec.requires.services.identity.oidc.postLogoutRedirectUris | []string | PostLogoutRedirectURIs lists the allowed post-logout redirect URIs. | |
status.profileSpec.requires.services.identity.oidc.redirectUris | []string | RedirectURIs lists the valid OAuth2 redirect URIs for the authorization code flow. | |
status.profileSpec.requires.services.identity.oidc.requestParameter | object | RequestParameter binds an authorization-request parameter of this client's sign-ins to where the code is delivered, and puts it in the access token: for an… | |
status.profileSpec.requires.services.identity.oidc.requestParameter.claim | string | Claim is the access-token claim the value is put in. | |
status.profileSpec.requires.services.identity.oidc.requestParameter.name | string | yes | Name is the parameter, as the app sends it on the authorization request. |
status.profileSpec.requires.services.identity.oidc.requestParameter.pattern | string | yes | Pattern is what the value must be, matched as a whole. |
status.profileSpec.requires.services.identity.oidc.requestParameter.redirectUri | string | yes | RedirectURI is the one address a code for the request is delivered to: https, with at least one ${group} for a named group of the pattern's match, and no… |
status.profileSpec.requires.services.identity.saml | object | SAML describes the SAML client to register in the tenant's Keycloak realm. | |
status.profileSpec.requires.services.identity.saml.acsUrl | string | yes | ACSURL is the SAML Assertion Consumer Service URL for the auth callback. |
status.profileSpec.requires.services.identity.saml.entityId | string | yes | EntityID is the SAML Service Provider Entity ID registered in Keycloak. |
status.profileSpec.requires.services.identity.sidecar | object | Sidecar signs people in through the platform's sign-in sidecar. | |
status.profileSpec.requires.services.identity.sidecar.appPort | integer (int32) | AppPort lets the handler call the app itself inside the cluster: it is the port the app's pods listen on, and the network path is opened to that port of the… | |
status.profileSpec.requires.services.identity.sidecar.database | boolean | Database gives the handler the app's own database: where it is and the app's own login to it, as DB_HOST, DB_PORT, DB_NAME, DB_USER and DB_PASSWORD, and the… | |
status.profileSpec.requires.services.identity.sidecar.entryPaths | []string | EntryPaths are paths of the app that lead to the sign-in instead of to the app: its front page, and the address of its own sign-in form. | |
status.profileSpec.requires.services.identity.sidecar.exposure | string | Exposure names the gateway entry people open the app at: the sidecar's two paths are on that entry's host. | |
status.profileSpec.requires.services.identity.sidecar.secrets | []string | Secrets gives the handler secrets of this app, by the names they have under spec.secrets.generated: each as SECRET_<NAME>, the name in upper case. | |
status.profileSpec.requires.services.llm | object | LLM declares that the component calls language models through the platform's model gateway. | |
status.profileSpec.requires.services.llm.optional | boolean | Optional means the component runs without the gateway. | |
status.profileSpec.requires.services.logDestination | object | LogDestination declares that the component receives the platform's log forwarder over HTTPS inside the cluster. | |
status.profileSpec.requires.services.logDestination.port | integer (int32) | yes | Port is the port that Service and its pods serve HTTPS on, the same number on both: it is the pods' port the network admits. |
status.profileSpec.requires.services.logDestination.service | string | yes | Service is the name of the component's Service the forwarder is sent to. |
status.profileSpec.requires.services.mail | object | Mail specifies SMTP and/or IMAP requirements. | |
status.profileSpec.requires.services.mail.imap | object | IMAP requests inbound mail (IMAP) credentials. | |
status.profileSpec.requires.services.mail.imap.tokenSignIn | boolean | TokenSignIn declares that the app opens a person's mailbox with that person's sign-in token (SASL XOAUTH2) instead of an app password. | |
status.profileSpec.requires.services.mail.smtp | object | SMTP requests outbound mail (SMTP submission) credentials. | |
status.profileSpec.requires.services.mcp | object | MCP declares that the component exposes a Model Context Protocol endpoint. | |
status.profileSpec.requires.services.mcp.auth | string | Auth is the authentication method the endpoint expects. | |
status.profileSpec.requires.services.mcp.enabled | boolean | yes | Enabled says the component exposes the endpoint. |
status.profileSpec.requires.services.mcp.endpoint | string | Endpoint is the HTTP path where the app exposes its MCP server. | |
status.profileSpec.requires.services.partners | object | Partners declares that the component calls apps of partner realms on a person's behalf, takes such calls, or commissions partners of other tenants. | |
status.profileSpec.requires.services.partners.accept | boolean | Accept says the component takes partners' assertions, turning each into the linked local account by the JWT authorization grant, for every partner the tenant… | |
status.profileSpec.requires.services.partners.call | []string | Call names the tenant's partners the component asks assertions towards (standard token exchange, scope partner-<name>): a person's token in, a token for the… | |
status.profileSpec.requires.services.partners.commission | boolean | Commission says the component asks the director to add receiving partners to the tenants that name it, or to take them away. | |
status.profileSpec.requires.services.partners.serviceAccount | string | ServiceAccount is the Kubernetes service account the component's pods run as; its token is the client's credential. | |
status.profileSpec.requires.services.rights | object | Rights declares that the component asks the platform whether a person may use an app of its tenant, for a person who is not at a browser. | |
status.profileSpec.requires.services.rights.audit | boolean | Audit lets the same key ask three more questions, for a person of the platform tenant: may they audit the cluster (cluster#can_audit), may they configure it… | |
status.profileSpec.requires.services.storage | object | Storage specifies object storage (S3) and/or filesystem (WebDAV) requirements. | |
status.profileSpec.requires.services.storage.files | object | Files requests WebDAV access to the tenant's file-storage service. | |
status.profileSpec.requires.services.storage.files.capabilities | []string | Capabilities lists the required access capabilities. | |
status.profileSpec.requires.services.storage.files.protocol | string | Protocol is the access protocol. | |
status.profileSpec.requires.services.storage.s3 | object | S3 requests a per-tenant S3 bucket from the platform's object store. | |
status.profileSpec.requires.services.storage.s3.objectLock | boolean | ObjectLock makes the bucket with S3 Object Lock, which cannot be switched off again, and lets the app read and set the bucket's default retention… | |
status.profileSpec.requires.services.turn | object | TURN declares that the component's clients relay real-time media through the platform's TURN edge. | |
status.profileSpec.requires.services.vouching | object | Vouching declares that the component obtains tokens of a person who is not at a browser, on the strength of that person's earlier consent: it signs a short… | |
status.profileSpec.requires.services.vouching.director | []string | Director names what a token the component obtains for a person may do at the platform's own API, beside the apps: plans-read reads the cluster's plans, its… | |
status.profileSpec.requires.services.vouching.keys | object | yes | Keys says where the component publishes the keys its statements are signed with, as a JWKS. |
status.profileSpec.requires.services.vouching.keys.path | string | Path is where the JWKS is served. | |
status.profileSpec.requires.services.vouching.keys.port | integer (int32) | yes | Port is the Service's port. |
status.profileSpec.requires.services.vouching.keys.service | string | yes | Service is the name of the component's Service. |
status.profileSpec.secrets | object | Secrets are values the platform generates and holds that have no external counterparty. | |
status.profileSpec.secrets.derived | []object | Derived secrets are keys the platform adds to the credentials Secret it manages for the component, under the names given. | |
status.profileSpec.secrets.derived[].key | string | yes | Key is the Secret key, and therefore the environment variable name when the app consumes the Secret with envFrom (e.g. |
status.profileSpec.secrets.generated | []object | Generated secrets are random, created once and held in the vault. | |
status.profileSpec.secrets.generated[].name | string | yes | Name is the logical identifier for this secret (e.g., "admin_password"). |
status.profileSpec.secrets.generated[].valuePath | string | yes | ValuePath is the dot-notation (or bracket-notation) Helm value key that should receive the generated secret value. |
status.profileSpec.secrets.supplied | []object | Supplied secrets are credentials only a person can provide. | |
status.profileSpec.secrets.supplied[].description | string | Description says what the credential is for and where to obtain it, for a tenant administrator who did not write the profile. | |
status.profileSpec.secrets.supplied[].displayName | string | yes | DisplayName is the label the form renders. |
status.profileSpec.secrets.supplied[].fields | []object | yes | Fields are the values the form collects, set together. |
status.profileSpec.secrets.supplied[].fields[].example | string | Example is a non-secret illustration of the expected shape. | |
status.profileSpec.secrets.supplied[].fields[].format | string | Format hints at how the form renders and checks the field. | |
status.profileSpec.secrets.supplied[].fields[].key | string | yes | Key is the property's name at the vault path and in the form. |
status.profileSpec.secrets.supplied[].fields[].public | boolean | Public marks a value that is not secret -- a publishable key, an account id -- which the form then shows as typed. | |
status.profileSpec.secrets.supplied[].fields[].valuePath | string | yes | ValuePath is the Helm value key that receives the value, as for a generated secret. |
status.profileSpec.secrets.supplied[].name | string | yes | Name identifies the credential within the app: the last part of its vault path and of the requirement's name, app-{tenant}-{app}-{name}. |
status.profileSpec.sessionMaxAge | string | SessionMaxAge caps, at the realm, how long a sign-in through the app's own OIDC clients lasts: the operator sets it as the clients' session lifespan, and past… | |
status.profileSpec.trustTier | string | yes | TrustTier is the review level of this entry. |
status.profileSpec.version | string | yes | Version is the catalog entry's version, not the upstream project's. |
17. ResourcePlan
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | resourceplans |
| Short names | rplan, rplans |
ResourcePlan is a named preset of tenant resource limits. It is deliberately not deployable. Nothing reconciles a ResourcePlan and it owns no namespace, workload or quota of its own: it exists so that a tenant's ceiling is chosen from a catalog rather than typed. Selecting one writes its quantities into that tenant's spec.quotas — see docs/concepts/resource-plans.md. Why a catalog at all, when Tenant.spec.quotas already accepts any quantity: a quota that can be any number can be any number that was never sold. The plan is the unit the platform prices, meters and invoices, so the write path accepts a plan name and nothing else, and every tenant's ceiling is at all times one of a known, priced set. Free-form quantities remain available to whoever edits the deployments repository by hand, which is the cluster operator, which is the person entitled to make an unpriced choice. This mirrors the role AppPackage plays for addons: a curated preset that replaces a combinatorial choice with a named one, without becoming an artifact of its own.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | ResourcePlanSpec is the desired state of a ResourcePlan. | |
spec.default | boolean | Default marks the plan a tenant is assumed to be on when its quotas match no plan in the catalog and none has been selected. | |
spec.description | string | Description explains what the plan is for, in one or two sentences. | |
spec.displayName | string | yes | DisplayName is the name shown in the Admin Console (e.g. |
spec.productSku | string | ProductSku identifies this plan to the commerce backend. | |
spec.quotas | object | yes | Quotas are the limits a tenant on this plan receives. |
spec.quotas.cpu | int-or-string | CPU caps the sum of container CPU limits in the namespace. | |
spec.quotas.maxApps | integer (int32) | MaxApps is the maximum number of apps this tenant may install. | |
spec.quotas.maxPods | integer (int32) | MaxPods caps the number of pods in the tenant namespace (init Jobs + app workloads). | |
spec.quotas.memory | int-or-string | Memory caps the sum of container memory limits in the namespace. | |
spec.quotas.requestsCpu | int-or-string | RequestsCPU caps the sum of container CPU requests in the namespace. | |
spec.quotas.requestsMemory | int-or-string | RequestsMemory caps the sum of container memory requests in the namespace — reserved capacity, priced, as RequestsCPU is. | |
spec.quotas.storage | int-or-string | Storage is the total storage quota (PVCs + S3 buckets). | |
spec.retired | boolean | Retired withholds the plan from every new choice and keeps it for the tenants already on it. | |
spec.tier | integer (int32) | yes | Tier orders plans from smallest to largest. |
spec.units | integer (int32) | Units is how many node units the plan is, for a commerce backend that sells a number of nodes rather than a named plan: it moves a tenant to the plan whose… | |
status | object | ResourcePlanStatus reports observed plan state. |
18. Tenant
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | tenants |
| Short names | tenant, tenants |
Tenant is the Schema for the tenants API. Tenant is cluster-scoped and represents a customer organization. Creating a Tenant CR triggers the orchestrator's full provisioning pipeline: namespace creation, Keycloak realm, per-app databases/buckets/cache, and ArgoCD Application (or Crossplane App claim) CRs for each requested app.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | ||
spec.admin | object | Admin is how the tenant's administrator account is handed over. | |
spec.admin.requireMFA | boolean | RequireMFA makes enrolling a second factor part of activating the account. | |
spec.apps | []object | Apps lists the applications to install for this tenant. | |
spec.apps[].addonGrants | []object | AddonGrants says which addons of this app every member of the tenant has access to by default. | |
spec.apps[].addonGrants[].defaultGrant | boolean | DefaultGrant says every member of the tenant has access to this addon by default, as an app's defaultGrant does for the app. | |
spec.apps[].addonGrants[].name | string | yes | Name is the addon's profile name, as addons lists it. |
spec.apps[].addonPins | []object | AddonPins pins addons of this app to the build each was installed from, like digest and catalog do for the app itself. | |
spec.apps[].addonPins[].catalogue | string | Catalogue is the catalog the pinned build was fetched from: the first half of its coordinate, <catalogue>/<name>. | |
spec.apps[].addonPins[].digest | string | yes | Digest pins the addon's profile bundle: the build the install asked for. |
spec.apps[].addonPins[].name | string | yes | Name is the addon's profile name, as addons lists it. |
spec.apps[].addons | []string | Addons lists the addon profiles activated inside this app for this tenant — customization-ladder rung L3. | |
spec.apps[].catalogue | string | Catalogue is the catalog the pinned build was fetched from: the first half of its coordinate, <catalogue>/<profile>. | |
spec.apps[].config | object | Config provides per-tenant overrides for this app installation. | |
spec.apps[].config.dropIns | []object | DropIns supply tenant-authored files into drop-in directories the target ComponentProfile declares as tenantEditable. | |
spec.apps[].config.dropIns[].files | map[string]string | yes | Files maps filename to content. |
spec.apps[].config.dropIns[].name | string | yes | Name must match a ComponentProfile.spec.customization.dropIns[].name entry that sets tenantEditable: true. |
spec.apps[].config.extraValues | object (free-form) | ExtraValues deep-merges Helm values over the profile's defaults. | |
spec.apps[].config.replicas | integer (int32) | Replicas overrides the default replica count. | |
spec.apps[].defaultGrant | boolean | DefaultGrant says every member of the tenant has access to this app by default. | |
spec.apps[].digest | string | Digest pins the profile bundle this app was installed from: the build the install asked for. | |
spec.apps[].movedAt | string | MovedAt is when the pin was last moved to another build, RFC 3339, and MovedBy who or what moved it: a person's id, or the policy that did ("policy:latest"). | |
spec.apps[].movedBy | string | ||
spec.apps[].placed | boolean | Placed says the platform put this app here, because its profile is placeable (ComponentProfile spec.placement). | |
spec.apps[].profile | string | Profile is the name of the ComponentProfile to install. | |
spec.apps[].profileRef | object | ProfileRef selects a ComponentProfile by catalog identity (family, version, edition, offering tier). | |
spec.apps[].profileRef.identity | object | Identity selects a profile by catalog tuple when Name is empty. | |
spec.apps[].profileRef.identity.catalogueVersion | string | yes | CatalogueVersion is the semver of this catalog entry. |
spec.apps[].profileRef.identity.edition | string | Edition selects the edition (ce, me, ie, pe, ee). | |
spec.apps[].profileRef.identity.family | string | yes | Family is the stable logical application id (e.g. |
spec.apps[].profileRef.name | string | Name is the ComponentProfile metadata.name. | |
spec.apps[].updateMode | string | UpdateMode overrides, for this tenant and this app, how the app moves to newer builds: latest (the platform moves it), manual (the cluster's administrator… | |
spec.catalogue | object | Catalogue is where this tenant may install from beside the catalogs the whole cluster offers: the catalogs only this tenant sees, and whether its own… | |
spec.catalogue.delegated | boolean | Delegated says the tenant's own administrators may add and remove catalogs for this tenant. | |
spec.catalogue.sources | []object | Sources are the catalogs only this tenant sees. | |
spec.catalogue.sources[].addedBy | string | AddedBy says who added it: the cluster's administrator, or the tenant's own under delegation. | |
spec.catalogue.sources[].name | string | yes | Name is the catalog's name: the first half of a coordinate, <name>/<app>. |
spec.catalogue.sources[].oci | object | OCI is an OCI artifact the catalog is kept as, in place of an address: read with the credential of a repository declared for this tenant, and with no other. | |
spec.catalogue.sources[].oci.artifact | string | yes | Artifact is the reference, without a scheme: <registry host>/<repository>:<tag>, or @sha256:<digest> in place of or after the tag. |
spec.catalogue.sources[].oci.repository | string | yes | Repository is the name of the repository whose credential the artifact is read with: one declared for the tenant, for a tenant's catalog; one declared for the… |
spec.catalogue.sources[].url | string | URL is the https address the catalog is served from. | |
spec.country | string | Country is the country the tenant is in, as an ISO 3166-1 alpha-2 code in upper case (CH, DE). | |
spec.deletion | object | Deletion refines what a Delete leaves behind. | |
spec.deletion.keepBundles | boolean | KeepBundles keeps the tenant's backup bucket and the bundles in it when everything else is deleted: the offboarding case, where the tenant was handed a copy… | |
spec.deletionPolicy | string | DeletionPolicy controls behavior when the Tenant CR is deleted. | |
spec.displayName | string | yes | DisplayName is a human-readable name for this tenant/organization. |
spec.exposures | []object | Exposures are the perimeter surfaces a perimeter approver published (AD-6): what this tenant has on the internet, from when, until when, and who said so. | |
spec.exposures[].alias | string | Alias is a second address for this surface, directly under the cluster's own domain: the one label of <alias>.<kernelDomain>. | |
spec.exposures[].aliasSetAt | string (date-time) | ||
spec.exposures[].aliasSetBy | string | AliasSetBy is the subject that set the alias, and AliasSetAt when. | |
spec.exposures[].apex | boolean | Apex is the approver saying that this surface is for the cluster's main address: the bare domain. | |
spec.exposures[].apexAcknowledgedAt | string (date-time) | ||
spec.exposures[].apexAcknowledgedBy | string | ApexAcknowledgedBy is the subject that acknowledged the rule for a website on the main address, and ApexAcknowledgedAt when: only a site whose scripts the… | |
spec.exposures[].expiresAt | string (date-time) | ExpiresAt is when it stops answering, for a surface published for a while. | |
spec.exposures[].exposureName | string | yes | ExposureName names an entry of that component's profile that asks for approval: one whose surface is perimeter, or one behind sign-in that declares the… |
spec.exposures[].install | string | yes | Install names the Component this publishes from. |
spec.exposures[].kind | string | Kind is what was approved, set by the director from what the profile's entry declared when the approver said yes: a public address, a public address that… | |
spec.exposures[].lastReviewedAt | string (date-time) | ||
spec.exposures[].lastReviewedBy | string | LastReviewedBy is the subject that last confirmed this should stay public, and LastReviewedAt when. | |
spec.exposures[].owner | string | yes | Owner is the subject that published it, set by the director from the caller's token. |
spec.exposures[].publishedAt | string (date-time) | PublishedAt is when it was first published. | |
spec.exposures[].reason | string | Reason is why this is public, in the approver's words. | |
spec.exposures[].reviewAt | string (date-time) | yes | ReviewAt is when the owner and the approver look at it again. |
spec.grants | []object | Grants are what each app of the tenant may consume from the others, and which of them may consume from it, as the tenant's administrators granted it… | |
spec.grants[].allowConsumers | []object | AllowConsumers controls which other installed apps may invoke this app's provides contracts. | |
spec.grants[].allowConsumers[].app | string | yes | App is the consumer ComponentProfile name. |
spec.grants[].allowConsumers[].contract | string | yes | Contract matches ComponentProfile.spec.provides[].name. |
spec.grants[].allowConsumers[].scope | []string | yes | Scope lists approved capability strings for the consumer. |
spec.grants[].app | string | yes | App is the installed ComponentProfile name (matches Tenant.spec.apps[].profile). |
spec.grants[].consume | []object | Consume lists contract capabilities this app may use from providers in the tenant. | |
spec.grants[].consume[].contract | string | yes | Contract matches IntegrationBinding.spec.contract. |
spec.grants[].consume[].granted | []string | yes | Granted lists approved capability strings (subset of the binding declaration). |
spec.grants[].grantedAt | string (date-time) | GrantedAt is when. | |
spec.grants[].grantedBy | string | GrantedBy is the Keycloak subject who granted it, set by the director from the caller's token, never supplied by a caller. | |
spec.grants[].reason | string | Reason in the granter's words, where they gave one. | |
spec.groups | []object | Groups are groups of the tenant's realm declared in git; see TenantGroup. | |
spec.groups[].name | string | yes | Name is the group's name in the realm. |
spec.isolation | object | Isolation describes the workload isolation boundaries for this tenant. | |
spec.isolation.databasePrefix | string | DatabasePrefix is the prefix for all database names belonging to this tenant. | |
spec.isolation.keycloakRealm | string | KeycloakRealm is the Keycloak realm name for this tenant. | |
spec.isolation.mode | string | Mode selects the isolation strategy. | |
spec.isolation.namespace | string | Namespace overrides the target namespace name. | |
spec.isolation.s3Prefix | string | S3Prefix is the prefix for all S3 bucket names belonging to this tenant. | |
spec.locales | []string | Locales are the languages this tenant's realm renders its login and account pages in, as ISO 639-1 codes (AD-15). | |
spec.mail | object | Mail configures the mail mode and settings for this tenant. | |
spec.mail.mode | string | Mode selects the mail delivery strategy. | |
spec.mail.smtpCredentialsSecret | string | SmtpCredentialsSecret is the name of an existing Kubernetes Secret in the kernel namespace that contains SMTP relay credentials for external mail delivery. | |
spec.organization | object | Organization is who the tenant is: the facts an app needs to set itself up for this organization rather than a placeholder (its company, its currency, its… | |
spec.organization.address | object | Address is where the organization is. | |
spec.organization.address.city | string | City is the city or town. | |
spec.organization.address.postalCode | string | PostalCode is the postal code. | |
spec.organization.address.region | string | Region is the state, canton or province, where the address has one. | |
spec.organization.address.street | string | Street is the street and number, a line per line of the address. | |
spec.organization.currency | string | Currency is the organization's currency, ISO 4217 (CHF, EUR). | |
spec.organization.email | string | Email is the organization's contact address. | |
spec.organization.fiscalYearStartMonth | integer (int32) | FiscalYearStartMonth is the month the organization's fiscal year begins in, 1 to 12. | |
spec.organization.legalName | string | LegalName is the name the organization is registered under (Example AG), beside the tenant's display name, which is what its people call it. | |
spec.organization.phone | string | Phone is the organization's phone number, preferably international (+41 44 123 45 67). | |
spec.organization.registrationNumber | string | RegistrationNumber is its number in the commercial register (CHE-123.456.789, HRB 12345). | |
spec.organization.taxId | string | TaxID is the organization's VAT number (CHE-123.456.789 MWST, DE123456789). | |
spec.organization.timeZone | string | TimeZone is the organization's time zone, an IANA name (Europe/Zurich). | |
spec.organization.website | string | Website is the organization's public site, an http(s) address. | |
spec.partnerCommissioners | []object | PartnerCommissioners are the components, of this tenant or another, that may ask the director to add a receiving partner (accept only) or take one away. | |
spec.partnerCommissioners[].profile | string | yes | Profile is the profile it runs. |
spec.partnerCommissioners[].tenant | string | yes | Tenant is the tenant the component runs in. |
spec.partners | []object | Partners are realms outside this tenant it has a relation with; see TenantPartner. | |
spec.partners[].accept | object | Accept lets the partner's people arrive here: the identity provider partner-<name>, with the JWT authorization grant. | |
spec.partners[].accept.accounts | string | yes | Accounts is what a first arrival becomes; see PartnerAccounts. |
spec.partners[].accept.displayName | string | DisplayName is the organization's name as people read it (organization only). | |
spec.partners[].accept.domain | string | Domain is the organization's domain (organization only): the domain of its people's addresses. | |
spec.partners[].as | string | As is the name the partner gives this realm: its broker endpoint for this realm is <issuer>/broker/partner-<as>/endpoint, the one address the partner client… | |
spec.partners[].issue | boolean | Issue lets this tenant's people sign in at the partner and its apps ask for assertions towards it: the partner client (client ID = Issuer) and the scope… | |
spec.partners[].issuer | string | yes | Issuer is the partner's realm, https://<host>/<path to the realm>. |
spec.partners[].name | string | yes | Name is the partner's name here: the realm's scope and identity provider for it are partner-<name>. |
spec.platformAccess | object | PlatformAccess is what the tenant opens to the platform's own people beyond the director: whether the platform's administrators may sign in to the tenant. | |
spec.platformAccess.adminsEnter | boolean | AdminsEnter says the members of the platform's administrators' group may sign in to this tenant, through the kernel realm, and hold its admins group for as… | |
spec.privileges | []object | Privileges are the privilege requests a person granted for this tenant's components (AD-5). | |
spec.privileges[].approvedAt | string (date-time) | yes | |
spec.privileges[].approver | string | yes | Approver is the Keycloak subject who said yes, set by the director from the caller's token. |
spec.privileges[].digest | string | Digest pins an apiExtensions grant to the definitions it approved: sha256 of the request as the approver read it (security.APIExtensionDigest). | |
spec.privileges[].expiresAt | string (date-time) | ExpiresAt bounds the grant. | |
spec.privileges[].install | string | yes | Install names the Component this grant is for, which is the component's object name in the tenant's namespace. |
spec.privileges[].privilege | string | yes | Privilege names one entry of the profile's request, as <kind>/<name>. |
spec.privileges[].reason | string | yes | Reason in the approver's words, not the profile's. |
spec.quotas | object | Quotas sets resource limits for this tenant. | |
spec.quotas.cpu | int-or-string | CPU caps the sum of container CPU limits in the namespace. | |
spec.quotas.maxApps | integer (int32) | MaxApps is the maximum number of apps this tenant may install. | |
spec.quotas.maxPods | integer (int32) | MaxPods caps the number of pods in the tenant namespace (init Jobs + app workloads). | |
spec.quotas.memory | int-or-string | Memory caps the sum of container memory limits in the namespace. | |
spec.quotas.requestsCpu | int-or-string | RequestsCPU caps the sum of container CPU requests in the namespace. | |
spec.quotas.requestsMemory | int-or-string | RequestsMemory caps the sum of container memory requests in the namespace — reserved capacity, priced, as RequestsCPU is. | |
spec.quotas.storage | int-or-string | Storage is the total storage quota (PVCs + S3 buckets). | |
spec.security | object | Security is the realm policy this tenant runs under: how strong a password has to be, how long a session lasts, what happens after repeated failures. | |
spec.security.bruteForce | object | BruteForce is what happens after repeated failures. | |
spec.security.bruteForce.enabled | boolean | Enabled turns detection on. | |
spec.security.bruteForce.lockoutDurationSeconds | integer (int32) | LockoutDurationSeconds is how long a lockout lasts. | |
spec.security.bruteForce.maxLoginFailures | integer (int32) | MaxLoginFailures before the account is locked out. | |
spec.security.password | object | Password is how strong a password must be. | |
spec.security.password.historyCount | integer (int32) | HistoryCount refuses a password the person has used in their last N. | |
spec.security.password.maxAgeDays | integer (int32) | MaxAgeDays forces a change after that many days. | |
spec.security.password.minLength | integer (int32) | MinLength is the shortest password accepted. | |
spec.security.password.requireDigits | boolean | RequireDigits, RequireLowercase, RequireUppercase and RequireSpecialChars each demand at least one of that kind. | |
spec.security.password.requireLowercase | boolean | ||
spec.security.password.requireSpecialChars | boolean | ||
spec.security.password.requireUppercase | boolean | ||
spec.security.session | object | Session is how long one lasts. | |
spec.security.session.idleMinutes | integer (int32) | IdleMinutes ends a session that has done nothing for this long. | |
spec.security.session.maxHours | integer (int32) | MaxHours ends it regardless of activity. | |
spec.security.session.rememberMe | boolean | RememberMe offers the longer session the realm is configured for. | |
spec.signInFrom | []object | SignInFrom are other tenants of this cluster whose people sign in here; see TenantSignInFrom. | |
spec.signInFrom[].groups | []string | Groups are the groups of this tenant its people are in: a name of spec.groups, or members (the tenant's members, who may enter it). | |
spec.signInFrom[].tenant | string | yes | Tenant is the other tenant. |
spec.signInTo | []string | SignInTo are other tenants of this cluster this tenant's people may sign in to with their account here: this tenant's half of the other's spec.signInFrom. | |
spec.signUp | object | SignUp is whether people make their own accounts in the realm. | |
spec.signUp.enabled | boolean | Enabled opens the realm's registration page: anybody on the internet may make an account, with an e-mail address as the login, a message to that address to… | |
spec.signUp.home | string | Home is where the people of such a tenant are sent instead of its desktop: the page of the app they made their account for, e.g. a website's account page. | |
spec.storeTerms | object | StoreTerms records that the tenant accepted the App Store's terms: which version, and when. | |
spec.storeTerms.acceptedAt | string (date-time) | yes | AcceptedAt is when they were accepted. |
spec.storeTerms.version | string | yes | Version is the version of the terms the store named when they were accepted. |
status | object | TenantStatus holds the observed state of a Tenant. | |
status.adminEmail | string | AdminEmail is the resolved contact address for this tenant, and the administrator's login: admin@<effectiveDomain>. | |
status.appCount | integer | AppCount is the total number of apps requested in spec. | |
status.conditions | []object | Conditions provides detailed status conditions using the standard metav1.Condition type. | |
status.conditions[].lastTransitionTime | string (date-time) | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer (int64) | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
status.conditions[].status | string | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.defaultGrantedApps | []string | DefaultGrantedApps lists the apps whose default grant (spec.apps[].defaultGrant) has been applied: the tenant's members at that moment were added to the app's… | |
status.domain | string | Domain is the custom domain a TenantDomain binds this tenant to, copied here by the operator so every consumer of EffectiveDomain reads it from the tenant… | |
status.mail | object | Mail holds the observed DNS record data produced by the mail reconciler. | |
status.mail.dkimPublicKey | string | DKIMPublicKey is the RSA public key for DKIM signing, base64-encoded (PKIX DER). | |
status.mail.dmarcRecord | string | DMARCRecord is the suggested DMARC TXT record value for _dmarc.<mail domain>. | |
status.mail.spfRecord | string | SPFRecord is the suggested SPF TXT record value for the mail domain. | |
status.mailboxDomain | string | MailboxDomain is the domain this tenant's people have mailboxes under on the cluster's own mail server. | |
status.namespace | string | Namespace is the resolved tenant namespace name. | |
status.observedGeneration | integer (int64) | ObservedGeneration is the last processed generation of the spec. | |
status.phase | string | Phase summarizes the overall lifecycle state. | |
status.provisionedApps | []string | ProvisionedApps lists apps that have been successfully provisioned. | |
status.readyApps | integer | ReadyApps is the number of apps that have been successfully provisioned. | |
status.resourcePlan | string | ResourcePlan is the plan whose selection was last recorded in the tenant's usage history: the value of the resource-plan annotation at the time the plan event… |
19. TenantDomain
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | tenantdomains |
| Short names | tdomain |
TenantDomain moves the tenant it is named after to spec.domain. It is not a field on the Tenant: a custom domain is a separate decision with its own author, written beside the tenant's manifest by the director (PUT /v1/clusters/{c}/tenants/{t}/domain, can_configure) and shown in a console that offers it. The operator copies the domain to the Tenant's status.domain, which is what every consumer reads.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | TenantDomainSpec binds a tenant to a custom domain. | |
spec.domain | string | yes | Domain is where the tenant is served instead of <tenant>.<kernelDomain>: its zone, its hosts, its mail and its people's logins all move to it. |
20. TenantExport
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Namespaced |
| Plural | tenantexports |
| Short names | texp, export |
TenantExport captures one tenant's data into an encrypted bundle.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | TenantExportSpec requests a point-in-time capture of one tenant's data. | |
spec.apps | []string | Apps limits the export to these installed profile names. | |
spec.destination | object | Destination overrides where this one bundle is written. | |
spec.destination.addressingStyle | string | AddressingStyle is how a bucket is named in a request to Endpoint: path (the default when empty) or virtualHost (BackupDestination). | |
spec.destination.bucket | string | Bucket holds the bundle. | |
spec.destination.credentialSecretRef | string | CredentialSecretRef names a Secret in the tenant's namespace holding accessKey and secretKey for this endpoint. | |
spec.destination.credentialSource | string | CredentialSource decides where mode: custom gets its keys. | |
spec.destination.endpoint | string | Endpoint is the S3 API URL for mode: custom, e.g. https://sos-ch-dk-2.exo.io. | |
spec.destination.mode | string | Mode selects between the policy's answer, the platform's own storage, an endpoint named here, and one of the tenant's own stores. | |
spec.destination.region | string | Region, for providers that require one — Exoscale SOS and AWS do, the platform's own object store does not. | |
spec.destination.source | string | Source names the tenant's store for mode: source, by the BundleSource's name (<tenant>.<label>). | |
spec.encryption | object | Encryption selects how the bundle is protected. | |
spec.encryption.mode | string | Mode selects the protection. | |
spec.encryption.passphraseSecretRef | object | PassphraseSecretRef names a Secret in this tenant's namespace holding the passphrase, used with mode: passphrase. | |
spec.encryption.passphraseSecretRef.key | string | Key defaults to "passphrase". | |
spec.encryption.passphraseSecretRef.name | string | yes | |
spec.encryption.recipients | []string | Recipients are age public keys (age1…) to encrypt to, used with mode: recipient. | |
spec.ttlSeconds | integer (int64) | TTLSeconds is how long the bundle should be kept before it may be collected. | |
status | object | TenantExportStatus reports progress, and carries the state needed to undo a half-finished export after a controller restart. | |
status.apps | []object | Apps reports per-app progress, including the window each app was paused for. | |
status.apps[].artefacts | []object | Artefacts lists each artifact captured for this app, or planned to be restored for it: what the bundle's manifest says the bundle holds. | |
status.apps[].artefacts[].claim | object | Claim is the volume claim a volume was captured from, as far as making it again takes. | |
status.apps[].artefacts[].claim.accessModes | []string | AccessModes are the claim's. | |
status.apps[].artefacts[].claim.annotations | map[string]string | ||
status.apps[].artefacts[].claim.labels | map[string]string | Labels and Annotations are the ones that say whose the claim is: the release it records is how the next install and a purge find it. | |
status.apps[].artefacts[].claim.size | string | yes | Size is the storage the claim asked for. |
status.apps[].artefacts[].claim.storageClass | string | StorageClass is the class the claim named, empty for the default. | |
status.apps[].artefacts[].databases | []string | Databases are, for an archive of the databases an app made itself (postgresOwned, mariadbOwned), each database it held as "<name in the bundle>=<name here>"… | |
status.apps[].artefacts[].kind | string | yes | Kind is postgres, postgresOwned, mariadb, mariadbOwned, s3, volume or secrets; for what is the tenant's own also identity, mailboxes or rights. |
status.apps[].artefacts[].name | string | yes | Name is what the artifact was captured from: the database, bucket or volume claim, by its name in the tenant the bundle was taken of; for secrets, the app. |
status.apps[].artefacts[].path | string | Path is the artifact's place in the bundle. | |
status.apps[].artefacts[].release | string | Release is the Helm release a captured volume claim recorded. | |
status.apps[].artefacts[].target | string | Target is where a restore puts the artifact: the database, bucket or claim of that kind in the tenant being restored into, which is named differently when the… | |
status.apps[].attempts | integer (int32) | Attempts counts capture Jobs run for this app. | |
status.apps[].authorization | object | Authorization says what was done with the app's authorization store: how many tuples an export put into the bundle, and when a restore put them back into a… | |
status.apps[].authorization.restoredAt | string (date-time) | RestoredAt is when a restore put the store back. | |
status.apps[].authorization.tuples | integer (int32) | Tuples is how many tuples the bundle holds of the store. | |
status.apps[].chartVersion | string | ChartVersion records the chart the app was running when captured. | |
status.apps[].completedUnits | []string | CompletedUnits records each capture Job that finished, by Job name. | |
status.apps[].digest | string | Digest is the pinned digest of the app's build, when the tenant pins one. | |
status.apps[].heldBackAt | string (date-time) | HeldBackAt is when a restore asked the edge to hold this app back (TenantRestoreStatus.HeldBack). | |
status.apps[].lastFailure | string | LastFailure is what the capture container actually said, from the last attempt that failed. | |
status.apps[].message | string | Message explains a non-terminal or failed state. | |
status.apps[].name | string | Name is the installed profile name. | |
status.apps[].phase | string | Phase is this app's own phase, using the same vocabulary as the export. | |
status.apps[].quiesceEnd | string (date-time) | ||
status.apps[].quiesceMode | string | QuiesceMode records how this app was actually paused — command (maintenance hook) or scale-down. | |
status.apps[].quiesceStart | string (date-time) | QuiesceStart and QuiesceEnd bound the window this app was paused for. | |
status.apps[].retained | boolean | Retained says the app is not installed: it was uninstalled and its data kept. | |
status.apps[].rolloutStart | string (date-time) | RolloutStart is when a restore started this app again on the restored data, after its post-restore commands. | |
status.apps[].secrets | object | Secrets says what was done with the app's own secrets: which an export put into the bundle, and which a restore set from it. | |
status.apps[].secrets.appliedAt | string (date-time) | AppliedAt is when the vault held the bundle's values. | |
status.apps[].secrets.deliveredAt | string (date-time) | DeliveredAt is when the app's Secrets held them too and its releases had been upgraded with them. | |
status.apps[].secrets.names | []string | Names are the secrets an export captured, or the ones a restore sets: those the bundle holds and the app's profile here declares. | |
status.apps[].secrets.notDeclared | []string | NotDeclared are the secrets the bundle holds that the app's profile here does not declare. | |
status.apps[].secrets.notHeld | []string | NotHeld are the secrets the app's profile here declares that the bundle holds no value for. | |
status.apps[].secrets.planned | boolean | Planned says Replaced and Releases are final: the stored values were compared with the bundle's. | |
status.apps[].secrets.releases | []object | Releases are the Helm releases that are handed a replaced secret as a value, each with the revision it was at before the secret was replaced. | |
status.apps[].secrets.releases[].name | string | yes | Name is the Release object's. |
status.apps[].secrets.releases[].revision | integer (int64) | Revision is the revision the release was at before. | |
status.apps[].secrets.replaced | []string | Replaced are the secrets the app was handed anew: those whose stored value was another than the bundle's and was replaced by it, and those the vault held… | |
status.apps[].stores | []string | Stores lists the kinds captured for this app (postgres, mariadb, s3, volumes), derived from the profile's requires.services. | |
status.bundle | object | Bundle locates the output. | |
status.bundle.addressingStyle | string | AddressingStyle is how the bucket was named in requests to Endpoint when the bundle was written: path (empty) or virtualHost. | |
status.bundle.bucket | string | Bucket holds the tenant's bundles. | |
status.bundle.credentialSecret | string | CredentialSecret names the Secret whose keys open this endpoint. | |
status.bundle.endpoint | string | Endpoint records the storage this bundle was actually written to, empty for the platform's own. | |
status.bundle.prefix | string | Prefix is the directory-like key prefix this bundle occupies. | |
status.bundle.region | string | Region accompanies Endpoint for tooling that needs it. | |
status.completedAt | string (date-time) | CompletedAt is when the export reached a terminal phase. | |
status.conditions | []object | Conditions carry the usual per-concern detail. | |
status.conditions[].lastTransitionTime | string (date-time) | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer (int64) | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
status.conditions[].status | string | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.encryption | object | Encryption records how the bundle was protected, so a restore knows what it needs before it starts and an operator can tell at a glance whether a bundle is… | |
status.encryption.mode | string | Mode is the protection used. | |
status.encryption.platformReadable | boolean | PlatformReadable states plainly whether any platform-held identity can decrypt this bundle. | |
status.encryption.recipients | []string | Recipients are the public keys the bundle was encrypted to. | |
status.notIncluded | []string | NotIncluded names what the tenant has that this export's bundle does not hold, beyond what no bundle holds: the data uninstalled apps left behind, which an… | |
status.observedGeneration | integer (int64) | ObservedGeneration is the spec generation this status was computed from. | |
status.phase | string | Phase is the overall lifecycle phase. | |
status.quiesced | []string | Quiesced names the apps currently paused for writes. | |
status.startedAt | string (date-time) | StartedAt is when the first app began capturing. |
21. TenantRestore
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Namespaced |
| Plural | tenantrestores |
| Short names | trst |
TenantRestore restores a tenant's data from a bundle.
| Field | Type | Required | Description |
|---|---|---|---|
spec | object | TenantRestoreSpec puts a bundle back into a live tenant. | |
spec.apps | []string | Apps limits the restore to these profiles. | |
spec.bundle | object | Bundle locates a bundle directly, for restoring one this cluster did not produce — a migration, or a rebuild where the original export is gone. | |
spec.bundle.addressingStyle | string | AddressingStyle is how the bucket was named in requests to Endpoint when the bundle was written: path (empty) or virtualHost. | |
spec.bundle.bucket | string | Bucket holds the tenant's bundles. | |
spec.bundle.credentialSecret | string | CredentialSecret names the Secret whose keys open this endpoint. | |
spec.bundle.endpoint | string | Endpoint records the storage this bundle was actually written to, empty for the platform's own. | |
spec.bundle.prefix | string | Prefix is the directory-like key prefix this bundle occupies. | |
spec.bundle.region | string | Region accompanies Endpoint for tooling that needs it. | |
spec.confirmTenant | string | yes | ConfirmTenant must equal the tenant being restored into. |
spec.decryption | object | Decryption supplies the key material for the bundle. | |
spec.decryption.identitySecretRef | object | IdentitySecretRef holds an age identity (AGE-SECRET-KEY-1…) for a recipient-encrypted bundle. | |
spec.decryption.identitySecretRef.key | string | Key defaults to "passphrase". | |
spec.decryption.identitySecretRef.name | string | yes | |
spec.decryption.passphraseSecretRef | object | PassphraseSecretRef holds the passphrase for a passphrase-encrypted bundle, in this tenant's namespace. | |
spec.decryption.passphraseSecretRef.key | string | Key defaults to "passphrase". | |
spec.decryption.passphraseSecretRef.name | string | yes | |
spec.exportRef | string | ExportRef names a TenantExport in this namespace to restore from. | |
spec.intoNewTenant | boolean | IntoNewTenant says the tenant restored into was made new for this bundle: an import. | |
spec.skipVersionCheck | boolean | SkipVersionCheck permits restoring an app's data into a build of the app older than the one that wrote it, or one whose version cannot be compared with it. | |
status | object | TenantRestoreStatus reports progress and what was decided during preflight. | |
status.apps | []object | Apps reports per-app progress. | |
status.apps[].artefacts | []object | Artefacts lists each artifact captured for this app, or planned to be restored for it: what the bundle's manifest says the bundle holds. | |
status.apps[].artefacts[].claim | object | Claim is the volume claim a volume was captured from, as far as making it again takes. | |
status.apps[].artefacts[].claim.accessModes | []string | AccessModes are the claim's. | |
status.apps[].artefacts[].claim.annotations | map[string]string | ||
status.apps[].artefacts[].claim.labels | map[string]string | Labels and Annotations are the ones that say whose the claim is: the release it records is how the next install and a purge find it. | |
status.apps[].artefacts[].claim.size | string | yes | Size is the storage the claim asked for. |
status.apps[].artefacts[].claim.storageClass | string | StorageClass is the class the claim named, empty for the default. | |
status.apps[].artefacts[].databases | []string | Databases are, for an archive of the databases an app made itself (postgresOwned, mariadbOwned), each database it held as "<name in the bundle>=<name here>"… | |
status.apps[].artefacts[].kind | string | yes | Kind is postgres, postgresOwned, mariadb, mariadbOwned, s3, volume or secrets; for what is the tenant's own also identity, mailboxes or rights. |
status.apps[].artefacts[].name | string | yes | Name is what the artifact was captured from: the database, bucket or volume claim, by its name in the tenant the bundle was taken of; for secrets, the app. |
status.apps[].artefacts[].path | string | Path is the artifact's place in the bundle. | |
status.apps[].artefacts[].release | string | Release is the Helm release a captured volume claim recorded. | |
status.apps[].artefacts[].target | string | Target is where a restore puts the artifact: the database, bucket or claim of that kind in the tenant being restored into, which is named differently when the… | |
status.apps[].attempts | integer (int32) | Attempts counts capture Jobs run for this app. | |
status.apps[].authorization | object | Authorization says what was done with the app's authorization store: how many tuples an export put into the bundle, and when a restore put them back into a… | |
status.apps[].authorization.restoredAt | string (date-time) | RestoredAt is when a restore put the store back. | |
status.apps[].authorization.tuples | integer (int32) | Tuples is how many tuples the bundle holds of the store. | |
status.apps[].chartVersion | string | ChartVersion records the chart the app was running when captured. | |
status.apps[].completedUnits | []string | CompletedUnits records each capture Job that finished, by Job name. | |
status.apps[].digest | string | Digest is the pinned digest of the app's build, when the tenant pins one. | |
status.apps[].heldBackAt | string (date-time) | HeldBackAt is when a restore asked the edge to hold this app back (TenantRestoreStatus.HeldBack). | |
status.apps[].lastFailure | string | LastFailure is what the capture container actually said, from the last attempt that failed. | |
status.apps[].message | string | Message explains a non-terminal or failed state. | |
status.apps[].name | string | Name is the installed profile name. | |
status.apps[].phase | string | Phase is this app's own phase, using the same vocabulary as the export. | |
status.apps[].quiesceEnd | string (date-time) | ||
status.apps[].quiesceMode | string | QuiesceMode records how this app was actually paused — command (maintenance hook) or scale-down. | |
status.apps[].quiesceStart | string (date-time) | QuiesceStart and QuiesceEnd bound the window this app was paused for. | |
status.apps[].retained | boolean | Retained says the app is not installed: it was uninstalled and its data kept. | |
status.apps[].rolloutStart | string (date-time) | RolloutStart is when a restore started this app again on the restored data, after its post-restore commands. | |
status.apps[].secrets | object | Secrets says what was done with the app's own secrets: which an export put into the bundle, and which a restore set from it. | |
status.apps[].secrets.appliedAt | string (date-time) | AppliedAt is when the vault held the bundle's values. | |
status.apps[].secrets.deliveredAt | string (date-time) | DeliveredAt is when the app's Secrets held them too and its releases had been upgraded with them. | |
status.apps[].secrets.names | []string | Names are the secrets an export captured, or the ones a restore sets: those the bundle holds and the app's profile here declares. | |
status.apps[].secrets.notDeclared | []string | NotDeclared are the secrets the bundle holds that the app's profile here does not declare. | |
status.apps[].secrets.notHeld | []string | NotHeld are the secrets the app's profile here declares that the bundle holds no value for. | |
status.apps[].secrets.planned | boolean | Planned says Replaced and Releases are final: the stored values were compared with the bundle's. | |
status.apps[].secrets.releases | []object | Releases are the Helm releases that are handed a replaced secret as a value, each with the revision it was at before the secret was replaced. | |
status.apps[].secrets.releases[].name | string | yes | Name is the Release object's. |
status.apps[].secrets.releases[].revision | integer (int64) | Revision is the revision the release was at before. | |
status.apps[].secrets.replaced | []string | Replaced are the secrets the app was handed anew: those whose stored value was another than the bundle's and was replaced by it, and those the vault held… | |
status.apps[].stores | []string | Stores lists the kinds captured for this app (postgres, mariadb, s3, volumes), derived from the profile's requires.services. | |
status.archivedMailboxes | []object | ArchivedMailboxes are the archived mailboxes the bundle holds: the mailboxes of people who had been removed from the bundle's tenant with their mail kept. | |
status.archivedMailboxes[].address | string | Address is the address the removed person received at, in the domain of the tenant restored into. | |
status.archivedMailboxes[].archive | string | yes | Archive is the archived mailbox's name in the domain's archive. |
status.archivedMailboxes[].archivedAt | string (date-time) | ArchivedAt is when it was archived, where the bundle was taken; By who chose that, as they were shown there. | |
status.archivedMailboxes[].by | string | ||
status.archivedMailboxes[].domain | string | Domain is the mail domain whose archive it is in. | |
status.archivedMailboxes[].messages | integer (int64) | ||
status.archivedMailboxes[].sizeBytes | integer (int64) | ||
status.bundle | object | Bundle is the bundle actually used, resolved from exportRef or spec. | |
status.bundle.addressingStyle | string | AddressingStyle is how the bucket was named in requests to Endpoint when the bundle was written: path (empty) or virtualHost. | |
status.bundle.bucket | string | Bucket holds the tenant's bundles. | |
status.bundle.credentialSecret | string | CredentialSecret names the Secret whose keys open this endpoint. | |
status.bundle.endpoint | string | Endpoint records the storage this bundle was actually written to, empty for the platform's own. | |
status.bundle.prefix | string | Prefix is the directory-like key prefix this bundle occupies. | |
status.bundle.region | string | Region accompanies Endpoint for tooling that needs it. | |
status.bundleSchemaVersion | integer | BundleSchemaVersion is the format version of the manifest this restore read. | |
status.complete | boolean | Complete says whether everything the bundle holds -- or, with spec.apps, everything asked for -- was put back. | |
status.completedAt | string (date-time) | ||
status.conditions | []object | Conditions carry Accepted (admitted, and preflight passed) and Complete, and OutsideGuarantee when the restore is not the round trip the platform guarantees… | |
status.conditions[].lastTransitionTime | string (date-time) | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
status.conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
status.conditions[].observedGeneration | integer (int64) | observedGeneration represents the .metadata.generation that the condition was set based upon. | |
status.conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
status.conditions[].status | string | yes | status of the condition, one of True, False, Unknown. |
status.conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
status.heldBack | []string | HeldBack names the apps the edge keeps unreachable while this restore runs: each is added before anything of it is changed, and the edge answers 503 on its… | |
status.importRemoved | boolean | ImportRemoved records that the uploaded bundle this restore read was removed from the import bucket, which happens once the restore has run to its end. | |
status.nameDerivation | string | NameDerivation says where the restore took the names of what it restores from. | |
status.notRestored | []object | NotRestored names every app the bundle holds that this restore did not put back, and why. | |
status.notRestored[].app | string | yes | App is the app's name in the bundle's manifest. |
status.notRestored[].reason | string | yes | Reason says why, in a sentence a person can act on. |
status.notes | []string | Notes are what a restore does not bring back by design, which whoever ran it has to act on. | |
status.observedGeneration | integer (int64) | ||
status.passwordResetRequired | boolean | PasswordResetRequired flags that members came back without credentials. | |
status.phase | string | Phase reuses the export vocabulary: Pending, Running, Ready, Failed. | |
status.quiesced | []string | Quiesced names apps paused right now, and exists for the same reason as the export's: it is the only record that survives a controller restart, and an app… | |
status.rights | object | Rights is what this restore does with the entries of the rights store the bundle holds: the ones it grants, the ones it withdraws, and the ones it does not… | |
status.rights.applied | boolean | Applied says the store holds what Grant and Withdraw say. | |
status.rights.grant | []string | Grant are written to the store: rights the bundle's tenant had been granted beyond what follows from its entry in git. | |
status.rights.notBrought | []string | NotBrought are entries the bundle holds that this restore does not write, each with the reason. | |
status.rights.provenance | string | Provenance is whether the bundle was written on this cluster, which decides whether what was granted in its tenant comes back: Proven (signed with this… | |
status.rights.provenanceMessage | string | ProvenanceMessage says the same in a sentence. | |
status.rights.waitingSince | string (date-time) | WaitingSince is when the restore began to wait for the operator to attach the tenant in the rights store, which has to come first. | |
status.rights.withdraw | []string | Withdraw are removed from the store: defaults the bundle's tenant no longer held. | |
status.source | object | Source is where and by what the bundle was written, as its manifest records it: what a profile's post-restore commands are told beside where the restore puts… | |
status.source.cluster | string | Cluster is the id of the cluster it was written on. | |
status.source.customDomain | string | CustomDomain is the custom domain a TenantDomain bound the tenant to there. | |
status.source.domain | string | Domain is the tenant's domain where it was written. | |
status.source.kernelDomain | string | KernelDomain is the domain of the cluster it was written on, the one its sign-in issuer is under. | |
status.source.platformVersion | string | PlatformVersion is the version line of the platform that wrote it. | |
status.sourceTenant | string | SourceTenant is the tenant the bundle was taken of, as its manifest records it: the tenant restored into, as a bundle of any other is refused. | |
status.startedAt | string (date-time) |
22. XTenant
| Attribute | Value |
|---|---|
| Group | gentianos.io |
| Version | v1alpha1 |
| Scope | Cluster |
| Plural | xtenants |
| Short names |
| Field | Type | Required | Description |
|---|---|---|---|
spec | object (free-form) | ||
status | object (free-form) |