Admin Domain

The Admin domain manages the foundational infrastructure of the Control Plane — environments, zones, and remote organizations (planned feature). These resources define where applications are deployed and how different cloud environments are connected.

This domain is typically managed by platform administrators, not application teams.

Custom Resources

Environment

Environment is the Schema for the environments API

Group: admin.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

EnvironmentSpec

Appears in: Environment

EnvironmentSpec defines the desired state of Environment

Field	Type	Default	Validation
realmName	string	—	Optional, maxLength: 63, pattern: ^[a-z0-9]+(-[a-z0-9]+)*$

EnvironmentStatus

Appears in: Environment

EnvironmentStatus defines the observed state of Environment

Field	Type	Default	Validation
conditions	Condition[]	—	Optional

Condition

Appears in: EnvironmentStatus, RemoteOrganizationStatus, ZoneStatus

Field	Type	Default	Validation
lastTransitionTime	string	—	Required, Format: date-time
message	string	—	Required, maxLength: 32768
observedGeneration	integer	—	Optional, Format: int64, minimum: 0
reason	string	—	Required, minLength: 1, maxLength: 1024, pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
status	string	—	Required, Enum: True \| False \| Unknown
type	string	—	Required, maxLength: 316, pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

RemoteOrganization

RemoteOrganization is the Schema for the remoteorganizations API

Group: admin.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

RemoteOrganizationSpec

Appears in: RemoteOrganization

RemoteOrganizationSpec defines the desired state of RemoteOrganization

Field	Type	Default	Validation
clientId	string	—	Required
clientSecret	string	—	Required
id	string	—	Required
issuerUrl	string	—	Required
url	string	—	Required
zone	ObjectRef	—	Required

ObjectRef

Appears in: RemoteOrganizationSpec, ZoneStatus

ObjectRef is a reference to a Kubernetes object It is similar to types.NamespacedName but has the required json tags for serialization

Field	Type	Default	Validation
name	string	—	Required
namespace	string	—	Required
uid	string	—	Optional

RemoteOrganizationStatus

Appears in: RemoteOrganization

RemoteOrganizationStatus defines the observed state of RemoteOrganization

Field	Type	Default	Validation
conditions	Condition[]	—	Optional
namespace	string	—	Required

Zone

Zone is the Schema for the zones API Group is the Schema for the groups API.

Group: admin.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

ZoneSpec

Appears in: Zone

ZoneSpec defines the desired state of Zone

Field	Type	Default	Validation
aiGateway	AiGateway	—	Optional
externalIdPolicies	ExternalIdPolicy[]	—	Optional, maxItems: 16
gateway	AiGateway	—	Required
identityProvider	IdentityProvider	—	Required
managedRoutes	ManagedRoutesConfig	—	Optional
permissions	Permissions	—	Optional
redis	Redis	—	Optional
visibility	string	—	Required, Enum: World \| Enterprise

AiGateway

Appears in: ZoneSpec

AiGateway configures a dedicated AI Gateway for this zone. When present, the zone supports MCP exposures routed through a separate gateway with streaming support (buffering disabled).

Field	Type	Default	Validation
admin	Admin	—	Required
presets	Presets[]	—	Required, minItems: 1, maxItems: 5

Admin

Appears in: AiGateway

Admin contains the admin credentials for the AI Gateway.

Field	Type	Default	Validation
clientId	string	—	Optional
clientSecret	string	—	Optional
url	string	—	Required, Format: uri

Presets

Appears in: AiGateway

Presets defines a list of gateway configuration presets for the AI Gateway. Same structure as the regular gateway presets, allowing feature-based preset selection.

Field	Type	Default	Validation
default	boolean	false	Required
features	Features[]	—	Optional
name	string	—	Required, pattern: ^[aA-zZ0-9]+(-?[aA-zZ0-9]+)*$
urls	Urls[]	—	Required, minItems: 1, maxItems: 5

Features

Appears in: Presets, ZoneStatus

Features is a list of features that are enabled on this Preset. This can be used to enable certain features on the zone when this preset is applied.

Field	Type	Default	Validation
enabled	boolean	—	Required
name	string	—	Required

Urls

Appears in: Presets

Urls defines a list of URLs (hostname + base path) that should be exposed by the gateway for this zone. At least one URL is required.

Field	Type	Default	Validation
basePath	string	—	Required, pattern: ^/.*$
hidden	boolean	—	Required
hostname	string	—	Required, maxLength: 253
port	integer	—	Optional, Format: int32, minimum: 1, maximum: 65535
scheme	string	https	Optional, Enum: http \| https

ExternalIdPolicy

Appears in: ZoneSpec

ExternalIdPolicies configures, per identifier scheme, the format and presence requirements for externalIds on Rovers and Applications bound to this zone. Empty means no enforcement for any scheme.

Field	Type	Default	Validation
pattern	string	—	Required, minLength: 1
required	boolean	false	Required
scheme	string	—	Required, minLength: 1, maxLength: 32, pattern: ^[a-z][a-z0-9]*$

IdentityProvider

Appears in: ZoneSpec

Field	Type	Default	Validation
admin	ZoneAdmin	—	Required
secretRotation	SecretRotation	—	Optional
url	string	—	Required, Format: uri

ZoneAdmin

Appears in: IdentityProvider

Field	Type	Default	Validation
clientId	string	—	Required
password	string	—	Required
url	string	—	Optional, Format: uri
userName	string	—	Required

SecretRotation

Appears in: IdentityProvider

SecretRotation contains the config for rotating secrets related to the default identity provider realm of this zone. If not set, secret rotation will be disabled.

Field	Type	Default	Validation
enabled	boolean	—	Required
expirationPeriod	string	—	Required
gracePeriod	string	—	Required
notificationThresholds	NotificationThresholds[]	—	Required, minItems: 1

NotificationThresholds

Appears in: SecretRotation

NotificationThresholds defines the schedule of reminder notifications before secret expiry. Each entry triggers a notification when the remaining time-to-expiry crosses that threshold. Only the tightest (smallest) matching threshold is evaluated per reconciliation cycle to avoid spamming. Example: [{before: "720h"}, {before: "168h", repeat: "24h"}] → single reminder at 30 days, then daily reminders starting at 7 days.

Field	Type	Default	Validation
before	string	—	Required
repeat	string	—	Optional

ManagedRoutesConfig

Appears in: ZoneSpec

ManagedRoutesConfig defines the configuration for managed routes in a zone. Managed routes are automatically created and managed by the system based on this configuration.

Field	Type	Default	Validation
routes	Routes[]	—	Optional

Routes

Appears in: ManagedRoutesConfig

Routes is the list of routes to be created for this zone. It may be used to create additional routes that are required for operating the zone

Field	Type	Default	Validation
name	string	—	Required, pattern: ^[a-z0-9]+(-?[a-z0-9]+)*$
path	string	—	Required, pattern: ^/.*$
type	string	—	Required, Enum: TeamAPI \| Proxy
url	string	—	Required, Format: uri

Permissions

Appears in: ZoneSpec

Permissions configuration for permission service integration

Field	Type	Default	Validation
apiBasePath	string	—	Required, pattern: ^/.*
consoleUrl	string	—	Optional, Format: uri

Redis

Appears in: ZoneSpec

Field	Type	Default	Validation
enableTLS	boolean	—	Optional
host	string	—	Required
password	string	—	Optional
port	integer	6379	Optional, minimum: 1, maximum: 65535

ZoneStatus

Appears in: Zone

ZoneStatus defines the observed state of Zone

Field	Type	Default	Validation
aiGateway	ObjectRef	—	Optional
conditions	Condition[]	—	Optional
features	Features[]	—	Optional
gateway	ObjectRef	—	Optional
gatewayAdminClient	ObjectRef	—	Optional
gatewayConsumer	ObjectRef	—	Optional
identityProvider	ObjectRef	—	Optional
identityRealm	ObjectRef	—	Optional
internalIdentityRealm	ObjectRef	—	Optional
links	Links	—	Optional
managedRoutes	ObjectRef[]	—	Optional
namespace	string	—	Optional
realmName	string	—	Optional
teamApiIdentityRealm	ObjectRef	—	Optional

Links

Appears in: ZoneStatus

Field	Type	Default	Validation
gatewayIssuer	string	—	Required, Format: uri
gatewayLmsIssuer	string	—	Optional, Format: uri
gatewayUrl	string	—	Required, Format: uri
internalIssuer	string	—	Optional, Format: uri
permissionsUrl	string	—	Optional, Format: uri
teamApiIssuer	string	—	Optional, Format: uri

Zone Provisioning

When a Zone is reconciled, the Admin operator bootstraps everything the zone needs to operate — so administrators no longer have to create these building blocks by hand. This includes the identity realms and the gateway admin client described below.

Identity realms and the rover client

Each zone gets two identity realms in its identity provider:

• A default identity realm (named after the environment) — used for normal API consumers and providers. It carries the zone's token claims (originZone, originStargate, clientId).
• An internal rover realm — used only for admin-config clients that the platform itself needs.

Inside the internal realm, the operator creates the rover client — the OAuth2 client the Gateway operator uses to authenticate against the gateway's admin API (its issuer is …/auth/realms/rover).

Both the realm and the client are created on every zone reconciliation — they are not optional and there is no flag to disable them. The only related input is gateway.admin.clientSecret: if you leave it empty the secret is generated for you (see Secret onboarding); if you supply one it becomes the rover client's secret.

Previously a manual step

The rover realm and rover client used to be created by hand during zone setup. The Zone handler now provisions both automatically on every reconcile.

Secret onboarding (defaulting webhook)

A Zone defaulting webhook processes a zone's sensitive fields before the resource is stored — the IDP admin password, the Redis password, and the gateway admin client secret.

• When Secret-Manager is enabled, the webhook uploads each value to Secret-Manager under a zones/<zone>/admin/... path and replaces the clear-text value in the Zone with a secret reference.
• When Secret-Manager is disabled, the same secrets are generated inline and kept on the resource.

Either way, you can leave a secret field empty to have one generated for you, or set it to the rotate keyword to force a new value. On updates, omitting a secret preserves the existing one, so re-applying a Zone never regenerates secrets by accident.

See Secret Manager Domain for how references are stored and resolved, and Admin Journey: Environments & Zones for the operator-facing guide.

Domain Interactions

• Gateway domain — Zones define which gateway instance is used. The Gateway operator reads the zone's gateway configuration (presets, URLs, features) when provisioning routes. Managed routes (TeamAPI and Proxy) are created directly by the zone handler.
• Identity domain — Zones define which identity provider is used. The Identity operator reads the zone's IDP configuration when provisioning clients and realms. The zone handler creates a default identity realm with token claims (originZone, originStargate, clientId) and the internal rover realm (with the rover gateway admin client) for admin-config clients.
• Organization domain — Teams are created within environments. Zones determine where team resources are provisioned. If a zone has TeamAPI-type managed routes, a team-api identity realm is created for team-facing APIs.
• Event domain — EventConfig resources reference zones for event routing and meshing.
• Secret Manager domain — The Zone defaulting webhook onboards zone secrets (IDP admin password, Redis password, gateway admin client secret) and stores references instead of clear-text values.

Related Pages

• Admin Journey: Environments & Zones
• Architecture Overview