MAQPNADocs

Tenant

Tenant (maqpna.com/v1alpha1): every field, type, default and validation rule, generated from the CRD schema.

Tenant isolates one customer of a shared MAQPNA installation: its namespaces, signing key and trust domain, audit ledger and WORM prefix, admin login and quotas.

At a glance#

Property Value
API version maqpna.com/v1alpha1
Kind Tenant
Scope Cluster
Plural tenants
Short names tn
Categories maqpna
Status subresource yes 
kubectl get tenants
kubectl get tn <name> -o yaml
kubectl explain tenants.spec

Columns in kubectl get#

Column Type From
TrustDomain string .status.trustDomain
Key string .status.keyId
Age date .metadata.creationTimestamp

Example#

From config/samples/tenant-acme.yaml:

# F-27: one customer of a shared (MSP / ISV) installation.
apiVersion: maqpna.com/v1alpha1
kind: Tenant
metadata:
  name: acme
spec:
  displayName: ACME GmbH
  namespaces: [acme-prod, acme-dev]
  trustDomain: acme.agents.example.eu
  auditWormPrefix: tenants/acme/audit
  admin:
    oidcAudience: maqpna-admin-acme
    roles:
      admin: [acme-platform-admins]
      auditor: [acme-dpo]
      approver: [acme-approvers]
  quotas:
    maxConcurrentSessions: 50
    perDayUSD: "200"
    onExceed: deny

Spec fields#

TenantSpec defines one tenant of a multi-tenant (ISV / MSP) installation.

Field Type Required Description
admin object admin is the tenant's own admin API login.
admin.oidcAudience string yes oidcAudience of the tenant's admin tokens (must differ from the platform admin audience). Min length: 1.
admin.oidcIssuer string oidcIssuer of the tenant's admin tokens (default: the gateway's adminAuth.oidc.issuer).
admin.roles map[string][]string roles maps a gateway role (admin, auditor, approver, viewer, killswitch) to groups (or "user:") of the tenant's IdP.
allowSharingWith []string allowSharingWith lists tenants that may use MCPServers shared from this tenant's namespaces ("*" = any). Cross-tenant sharing is forbidden otherwise (the gateway refuses it and the Tenant reports IsolationViolation).
auditWormPrefix string auditWormPrefix is the WORM object-key prefix of the tenant's ledger segments (default tenants//audit). Pattern: ^[a-zA-Z0-9][a-zA-Z0-9/._-]*$.
displayName string displayName is informational.
namespaces []string yes namespaces the tenant owns. A namespace belongs to at most one tenant; the operator labels it maqpna.com/tenant=. Min items: 1. Max items: 256.
quotas object quotas applied to every tenant namespace.
quotas.currency string currency is the ISO 4217 code of the perUSD amounts (default USD; the USD field names are legacy, see docs/api-conventions.md). It must equal the gateway's budgetCurrency: amounts are never converted and the gateway rejects budgets in another currency. Pattern: ^[A-Z]{3}$.
quotas.maxConcurrentSessions integer (int32) Minimum: 0.
quotas.onExceed string onExceed: deny (default), require_approval or alert. One of: deny, require_approval, alert.
quotas.perDayUSD int or string Pattern: ^(\+\|-)?(([0-9]+(\.[0-9]*)?)\|(\.[0-9]+))(([KMGTPE]i)\|[numkMGTPE]\|([eE](\+\|-)?(([0-9]+(\.[0-9]*)?)\|(\.[0-9]+))))?$.
quotas.perMonthUSD int or string Pattern: ^(\+\|-)?(([0-9]+(\.[0-9]*)?)\|(\.[0-9]+))(([KMGTPE]i)\|[numkMGTPE]\|([eE](\+\|-)?(([0-9]+(\.[0-9]*)?)\|(\.[0-9]+))))?$.
quotas.perSessionUSD int or string Pattern: ^(\+\|-)?(([0-9]+(\.[0-9]*)?)\|(\.[0-9]+))(([KMGTPE]i)\|[numkMGTPE]\|([eE](\+\|-)?(([0-9]+(\.[0-9]*)?)\|(\.[0-9]+))))?$.
signingKeySecretRef object signingKeySecretRef is the tenant's token-signing key; generated when unset.
signingKeySecretRef.key string key in the Secret (default key.pem).
signingKeySecretRef.name string yes Min length: 1. Max length: 253.
signingKeySecretRef.namespace string yes Min length: 1. Max length: 63.
trustDomain string trustDomain is the SPIFFE trust domain of the tenant's session identities (default .). Pattern: ^[a-z0-9._-]+$.

Status fields#

TenantStatus is the observed state of a Tenant.

The operator writes status; do not set it yourself.

Field Type Required Description
budgetPolicy string budgetPolicy generated for the quotas.
conditions []object conditions: Ready, NamespacesOwned, KeyReady, Isolated.
conditions[].lastTransitionTime string (date-time) yes lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
conditions[].message string yes message is a human readable message indicating details about the transition. This may be an empty string. Max length: 32768.
conditions[].observedGeneration integer (int64) observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Minimum: 0.
conditions[].reason string yes reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. Min length: 1. Max length: 1024. Pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$.
conditions[].status string yes status of the condition, one of True, False, Unknown. One of: True, False, Unknown.
conditions[].type string yes type of condition in CamelCase or in foo.example.com/CamelCase. Max length: 316. Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$.
isolationViolations []string isolationViolations lists cross-tenant shares the gateway refuses.
keyId string keyId is the RFC 7638 thumbprint of the tenant's signing key.
namespaces []string namespaces actually owned (labelled).
observedGeneration integer (int64)
trustDomain string trustDomain in effect.