MAQPNADocs

TrustTier

TrustTier (maqpna.com/v1alpha1): every field, type, default and validation rule, generated from the CRD schema.

TrustTier is a cluster-scoped isolation and sovereignty class.

At a glance#

Property Value
API version maqpna.com/v1alpha1
Kind TrustTier
Scope Cluster
Plural trusttiers
Short names tier, tt
Categories maqpna
Status subresource yes 
kubectl get trusttiers
kubectl get tier <name> -o yaml
kubectl explain trusttiers.spec

Columns in kubectl get#

Column Type From
Runtime string .spec.runtimeClassName
Isolation string .spec.isolation
Jurisdiction string .spec.jurisdiction
WarmReady integer .status.warmPoolReady
Age date .metadata.creationTimestamp

Example#

From config/samples/tier-0-gvisor.yaml:

apiVersion: maqpna.com/v1alpha1
kind: TrustTier
metadata:
  name: tier-0-gvisor
spec:
  runtimeClassName: gvisor
  isolation: gvisor
  jurisdiction: EU-DE
  egress: gateway-only
  allowedNodeLabels:
    topology.kubernetes.io/region: eu-central-1
  defaultResources:
    requests:
      cpu: 250m
      memory: 512Mi
    limits:
      cpu: "1"
      memory: 1Gi
  maxSessionTTL: 8h

From config/samples/tier-1-microvm.yaml:

apiVersion: maqpna.com/v1alpha1
kind: TrustTier
metadata:
  name: tier-1-microvm
spec:
  runtimeClassName: kata-fc
  isolation: microvm
  jurisdiction: EU-DE
  egress: gateway-only
  # Warm-pool path: sessions are provisioned via an upstream SandboxClaim against
  # the SandboxWarmPool "maqpna-tier-1-microvm", created from this SandboxTemplate
  # in each warm-pool namespace.
  sandboxTemplateName: coder-microvm
  warmPoolSize: 2
  warmPoolNamespaces:
  - team-a
  allowedNodeLabels:
    topology.kubernetes.io/region: eu-central-1
  defaultResources:
    limits:
      cpu: "2"
      memory: 4Gi
  maxSessionTTL: 4h

Spec fields#

TrustTierSpec defines an isolation / sovereignty class that Agents run in.

Field Type Required Description
allowedNodeLabels map[string]string allowedNodeLabels constrains sandbox scheduling via required node affinity (e.g. topology.kubernetes.io/region: eu-central-1).
allowedProviderTools []string allowedProviderTools caps the provider-hosted server tools Agents in this tier may enable with spec.model.providerTools: the gateway route gets the intersection. A canonical name (web_search) admits its versioned types (web_search_20250305); a versioned entry admits only itself. Empty or absent: none allowed. Max items: 16.
attestationRequired boolean attestationRequired requires remote attestation evidence before the identity broker will mint tokens for sessions in this tier.
defaultResources object defaultResources applied to agent containers that do not set resources.
defaultResources.claims []object Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This field depends on the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers.
defaultResources.claims[].name string yes Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.
defaultResources.claims[].request string Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.
defaultResources.limits map[string]int or string Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
defaultResources.requests map[string]int or string Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
egress string egress is the egress posture for sandboxes in this tier. One of: gateway-only, deny-all. Default: "gateway-only".
isolation string yes isolation describes the isolation boundary provided by the runtime class. One of: gvisor, microvm, confidential.
jurisdiction string jurisdiction is the data-residency jurisdiction this tier guarantees (e.g. "EU-DE").
maxSessionTTL string maxSessionTTL caps the lifetime of any session in this tier.
runtimeClassName string yes runtimeClassName is the Kubernetes RuntimeClass used for sandbox pods (e.g. gvisor, kata-fc, kata-qemu-snp). Min length: 1.
sandboxTemplateName string sandboxTemplateName optionally names an upstream agent-sandbox SandboxTemplate. When set, sessions are provisioned through a SandboxClaim (warm pool path) instead of a directly-created Sandbox.
warmPoolNamespaces []string warmPoolNamespaces lists the namespaces in which an upstream SandboxWarmPool (and the referenced SandboxTemplate) live. Upstream warm pools and templates are namespaced while TrustTier is cluster-scoped; defaults to the operator's --warmpool-namespace flag when empty.
warmPoolSize integer (int32) warmPoolSize is the number of pre-warmed sandboxes to keep per warm-pool namespace. Only effective when sandboxTemplateName is set. Minimum: 0.

Status fields#

TrustTierStatus is the observed state of a TrustTier.

The operator writes status; do not set it yourself.

Field Type Required Description
conditions []object
conditions[].lastTransitionTime string (date-time) yes lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
conditions[].message string yes message is a human readable message indicating details about the transition. This may be an empty string. Max length: 32768.
conditions[].observedGeneration integer (int64) observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Minimum: 0.
conditions[].reason string yes reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. Min length: 1. Max length: 1024. Pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$.
conditions[].status string yes status of the condition, one of True, False, Unknown. One of: True, False, Unknown.
conditions[].type string yes type of condition in CamelCase or in foo.example.com/CamelCase. Max length: 316. Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$.
observedGeneration integer (int64)
warmPoolReady integer (int32) warmPoolReady is the sum of ready replicas across this tier's warm pools.