Resources (CRDs)

All 13 MAQPNA custom resources with their fields, generated from the CRD schemas.

MAQPNA extends Kubernetes with these custom resources in the API group maqpna.com. Each page is generated from the CRD the chart installs, so it always matches the API server.

Kind	Scope	Short names	What it is
A2APeer	Namespaced	`a2ap`, `peer`	A2APeer is a remote A2A agent that local agents may call through the gateway (F-15).
Agent	Namespaced	`mqagent`, `ag`	Agent is a governed AI agent definition.
AgentRevocation	Namespaced	`arev`	AgentRevocation revokes agent tokens at the gateway within seconds and optionally suspends or terminates the matching sessions. Revocations are namespaced (they only match sessions of their namespace) except in the gateway namespace, where they apply cluster-wide.
AgentSession	Namespaced	`asess`, `as`, `sess`	AgentSession is one sandboxed, identity-bound run of an Agent.
AgentSessionSnapshot	Namespaced	`asnap`, `snap`	AgentSessionSnapshot is a point-in-time capture of an AgentSession that new sessions fork (or resume) from via spec.fork.fromSnapshot.
BudgetPolicy	Cluster	`bp`	BudgetPolicy sets namespace and user budgets enforced by the gateway on MCP tool calls and model traffic. When several BudgetPolicies set a limit for the same key, the smallest limit wins.
ConnectedAccount	Namespaced	`conn`, `ca`	ConnectedAccount is a status-only view of one user's OAuth connection in the gateway's per-user token vault (F-17). The gateway creates and updates it; deleting the user's connection (DELETE /v1/connect/ or the F-03 kill switch) marks it Revoked.
MCPServer	Namespaced	`mcps`, `mcp`	MCPServer registers an MCP server with the gateway's per-namespace tool registry. Agents in the same namespace reach it at /mcp/ with scope tools:.
MemoryStore	Namespaced	`mem`, `ms`	MemoryStore is a governed, residency-bound session memory store.
SovereigntyPolicy	Cluster	`sovpol`, `sp`	SovereigntyPolicy is a cluster-scoped data-sovereignty policy. The operator enforces the one named "default".
Tenant	Cluster	`tn`	Tenant isolates one customer of a shared MAQPNA installation: its namespaces, signing key and trust domain, audit ledger and WORM prefix, admin login and quotas.
ToolPolicy	Namespaced	`tp`	ToolPolicy is enforced by the MAQPNA gateway on every MCP tool call.
TrustTier	Cluster	`tier`, `tt`	TrustTier is a cluster-scoped isolation and sovereignty class.

flowchart LR
  T[Tenant] --> A[Agent]
  TT[TrustTier] --> A
  A --> S[AgentSession]
  TP[ToolPolicy] --> S
  B[BudgetPolicy] --> S
  M[MCPServer] --> S
  SP[SovereigntyPolicy] -.admission.-> S
  P[A2APeer] --> S
  CA[ConnectedAccount] --> S
  MS[MemoryStore] --> S
  S --> SN[AgentSessionSnapshot]
  R[AgentRevocation] -.revokes.-> S

How the kinds relate and who reconciles them: CRD data model. Rules for changing them between releases: additive only in v1alpha1.