Admin Domain

The Admin domain manages the foundational infrastructure of the Control Plane — environments, zones, and remote organizations (planned feature). These resources define where applications are deployed and how different cloud environments are connected.

This domain is typically managed by platform administrators, not application teams.

Custom Resources

Environment

Environment is the Schema for the environments API

Group: admin.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

EnvironmentSpec

Appears in: Environment

EnvironmentSpec defines the desired state of Environment

Field	Type	Default	Validation
realmName	string	—	Optional, maxLength: 63, pattern: ^[a-z0-9]+(-[a-z0-9]+)*$

EnvironmentStatus

Appears in: Environment

EnvironmentStatus defines the observed state of Environment

Field	Type	Default	Validation
conditions	Condition[]	—	Optional

Condition

Appears in: EnvironmentStatus, RemoteOrganizationStatus, ZoneStatus

Field	Type	Default	Validation
lastTransitionTime	string	—	Required, Format: date-time
message	string	—	Required, maxLength: 32768
observedGeneration	integer	—	Optional, Format: int64, minimum: 0
reason	string	—	Required, minLength: 1, maxLength: 1024, pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
status	string	—	Required, Enum: True \| False \| Unknown
type	string	—	Required, maxLength: 316, pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

RemoteOrganization

RemoteOrganization is the Schema for the remoteorganizations API

Group: admin.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

RemoteOrganizationSpec

Appears in: RemoteOrganization

RemoteOrganizationSpec defines the desired state of RemoteOrganization

Field	Type	Default	Validation
clientId	string	—	Required
clientSecret	string	—	Required
id	string	—	Required
issuerUrl	string	—	Required
url	string	—	Required
zone	ObjectRef	—	Required

ObjectRef

Appears in: RemoteOrganizationSpec, ZoneGateway, ZoneStatus, ZonePreset

ObjectRef is a reference to a Kubernetes object It is similar to types.NamespacedName but has the required json tags for serialization

Field	Type	Default	Validation
name	string	—	Required
namespace	string	—	Required
uid	string	—	Optional

RemoteOrganizationStatus

Appears in: RemoteOrganization

RemoteOrganizationStatus defines the observed state of RemoteOrganization

Field	Type	Default	Validation
conditions	Condition[]	—	Optional
namespace	string	—	Required

Zone

Zone is the Schema for the zones API Group is the Schema for the groups API.

Group: admin.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

ZoneSpec

Appears in: Zone

ZoneSpec defines the desired state of Zone

Field	Type	Default	Validation
externalIdPolicies	ExternalIdPolicy[]	—	Optional, maxItems: 16
features	Feature[]	—	Optional
gateways	Gateway[]	—	Required, minItems: 1, maxItems: 10
identityProviders	IdentityProvider[]	—	Required, minItems: 1, maxItems: 1
managedRoutes	ManagedRoutesConfig	—	Optional
permissions	Permissions	—	Optional
presets	Preset[]	—	Required, minItems: 1, maxItems: 10
redis	Redis	—	Optional
visibility	string	—	Required, Enum: World \| Enterprise

ExternalIdPolicy

Appears in: ZoneSpec

ExternalIdPolicies configures, per identifier scheme, the format and presence requirements for externalIds on Rovers and Applications bound to this zone. Empty means no enforcement for any scheme.

Field	Type	Default	Validation
pattern	string	—	Required, minLength: 1
required	boolean	false	Required
scheme	string	—	Required, minLength: 1, maxLength: 32, pattern: ^[a-z][a-z0-9]*$

Feature

Appears in: ZoneSpec, Preset, ZoneStatus

Features configures capabilities that apply to the entire zone.

Field	Type	Default	Validation
enabled	boolean	—	Required
name	string	—	Required

Gateway

Appears in: ZoneSpec

Field	Type	Default	Validation
admin	GatewayAdminConfig	—	Required
name	string	—	Required, pattern: ^[a-z0-9]+(-?[a-z0-9]+)*$

GatewayAdminConfig

Appears in: Gateway

GatewayAdminConfig contains the necessary information to connect to the gateway admin API for this zone. Most of it can be optional if the Gateway was setup to support it, then only the URL is required. The OAuth client used to call the admin API is system-managed: every gateway of a zone shares one "rover" client whose credentials cannot be configured here.

Field	Type	Default	Validation
identityProviderRef	string	—	Required
url	string	—	Required, Format: uri

IdentityProvider

Appears in: ZoneSpec

Field	Type	Default	Validation
admin	Admin	—	Required
allowedOrigins	string[]	—	Optional
issuerHostname	string	—	Optional, Format: hostname, maxLength: 253
name	string	—	Required, pattern: ^[a-z0-9]+(-?[a-z0-9]+)*$
secretRotation	SecretRotation	—	Optional
tokenUrl	string	—	Optional, Format: uri

Admin

Appears in: IdentityProvider

Field	Type	Default	Validation
clientId	string	—	Required
password	string	—	Required
url	string	—	Optional, Format: uri
userName	string	—	Required

SecretRotation

Appears in: IdentityProvider

Field	Type	Default	Validation
enabled	boolean	—	Required
expirationPeriod	string	—	Required
gracePeriod	string	—	Required
notificationThresholds	NotificationThresholds[]	—	Required, minItems: 1

NotificationThresholds

Appears in: SecretRotation

NotificationThresholds defines the schedule of reminder notifications before secret expiry. Each entry triggers a notification when the remaining time-to-expiry crosses that threshold. Only the tightest (smallest) matching threshold is evaluated per reconciliation cycle to avoid spamming. Example: [{before: "720h"}, {before: "168h", repeat: "24h"}] → single reminder at 30 days, then daily reminders starting at 7 days.

Field	Type	Default	Validation
before	string	—	Required
repeat	string	—	Optional

ManagedRoutesConfig

Appears in: ZoneSpec

ManagedRoutesConfig defines the configuration for managed routes in a zone. Managed routes are automatically created and managed by the system based on this configuration.

Field	Type	Default	Validation
routes	Routes[]	—	Optional

Routes

Appears in: ManagedRoutesConfig

Routes is the list of routes to be created for this zone. It may be used to create additional routes that are required for operating the zone

Field	Type	Default	Validation
name	string	—	Required, pattern: ^[a-z0-9]+(-?[a-z0-9]+)*$
path	string	—	Required, pattern: ^/.*$
type	string	—	Required, Enum: TeamAPI \| Proxy
url	string	—	Required, Format: uri

Permissions

Appears in: ZoneSpec

Permissions configuration for permission service integration

Field	Type	Default	Validation
apiBasePath	string	—	Required, pattern: ^/.*
consoleUrl	string	—	Optional, Format: uri

Preset

Appears in: ZoneSpec

Field	Type	Default	Validation
default	boolean	—	Optional
features	Feature[]	—	Optional
gatewayRef	string	—	Required
identityProviderRef	string	—	Required
name	string	—	Required, pattern: ^[a-z0-9]+(-?[a-z0-9]+)*$
tokenUrl	string	—	Optional, Format: uri
type	string	—	Required, Enum: API \| AI \| Event
urls	Urls[]	—	Required, minItems: 1, maxItems: 5

Urls

Appears in: Preset

Urls is the list of URLs (hostnames + base paths) exposed by the gateway for this preset.

Field	Type	Default	Validation
basePath	string	/	Optional, pattern: ^/.*$
hidden	boolean	false	Optional
hostname	string	—	Required, Format: hostname, maxLength: 253
port	integer	—	Optional, Format: int32, minimum: 1, maximum: 65535
scheme	string	https	Optional, Enum: http \| https

Redis

Appears in: ZoneSpec

Field	Type	Default	Validation
enableTLS	boolean	—	Optional
host	string	—	Required
password	string	—	Optional
port	integer	6379	Optional, minimum: 1, maximum: 65535

ZoneStatus

Appears in: Zone

ZoneStatus defines the observed state of Zone

Field	Type	Default	Validation
conditions	Condition[]	—	Optional
features	Feature[]	—	Optional
gateways	ZoneGateway[]	—	Optional
identityProvider	ObjectRef	—	Optional
identityRealm	ObjectRef	—	Optional
internalIdentityRealm	ObjectRef	—	Optional
managedRoutes	ObjectRef[]	—	Optional
namespace	string	—	Optional
presets	ZonePreset[]	—	Optional
realmName	string	—	Optional
teamApiIdentityRealm	ObjectRef	—	Optional

ZoneGateway

Appears in: ZoneStatus

Field	Type	Default	Validation
adminClient	ObjectRef	—	Optional
consumer	ObjectRef	—	Optional
gateway	ObjectRef	—	Optional
name	string	—	Required
types	string[]	—	Optional

ZonePreset

Appears in: ZoneStatus

Field	Type	Default	Validation
gatewayRef	ObjectRef	—	Optional
identityProviderRef	ObjectRef	—	Optional
links	Links	—	Optional
name	string	—	Required

Links

Appears in: ZonePreset

Field	Type	Default	Validation
gatewayIssuer	string	—	Required, Format: uri
gatewayLmsIssuer	string	—	Optional, Format: uri
gatewayUrl	string	—	Required, Format: uri
internalIssuer	string	—	Optional, Format: uri
permissionsUrl	string	—	Optional, Format: uri
teamApiIssuer	string	—	Optional, Format: uri
tokenUrl	string	—	Optional, Format: uri

Zone Provisioning

When a Zone is reconciled, the Admin operator bootstraps everything the zone needs to operate — so administrators no longer have to create these building blocks by hand. This includes the identity realms and the gateway admin client described below.

Readiness semantics

A Zone remains not ready until its initial managed sub-resources are ready. Once initial provisioning succeeds, Ready=True is latched and represents successful provisioning rather than continuous aggregate child health. Later child degradation, child updates, and Zone spec changes do not clear it; the operator reports each child observed as not ready during reconciliation through a Warning event on the Zone. Reconciliation errors continue to use the normal controller error handling.

Provisioning order

The Admin operator creates the identity provider and the two identity realms first. It waits until all three report Ready=True before creating the clients, gateway resources, and routes that depend on them. This prevents requests from reaching the identity provider before the realms are active.

While it waits, the Zone reports Ready=False with reason SubResourceNotReady and names the resource that is not ready. Changes to that resource automatically trigger another reconciliation. Once the Zone has completed its initial provisioning, this readiness check no longer blocks later updates.

Identity realms and the rover client

Each zone gets two identity realms in its identity provider:

• A default identity realm (named after the environment) — used for normal API consumers and providers. It carries the zone's token claims (originZone, originStargate, clientId).
• An internal rover realm — used only for admin-config clients that the platform itself needs.

Inside the internal realm, the operator creates the rover client — the OAuth2 client the Gateway operator uses to authenticate against the gateway's admin API (its issuer is …/auth/realms/rover). The Gateway's spec.admin.issuerUrl and each preset's links.internalIssuer use the internal realm's resolved status.issuerUrl (with any trailing / trimmed), so they point at the rover host even when the default realm is published on a different public host; until that issuer is resolved, the Zone reconciliation is retried.

The Admin operator manages exactly one rover client per Zone, shared by all of its gateways, including those serving AI traffic. Each Zone must use its own backing identity provider; clients are not shared across Zones. Provisioning is automatic and cannot be disabled. Administrators configure gateway admin endpoints and their identity provider association, but cannot override the gateway admin client ID or secret through the Zone.

The client is managed independently of individual gateways. Reconciliation preserves an existing client's secret while updating its non-secret settings, so adding or reordering gateways does not rotate credentials. Gateways receive the shared credentials only after the client resource has been created or updated successfully.

With Secret-Manager enabled, the secret is stored at the stable environment-scoped path zones/<zone>/admin/rover/clientSecret. The identity Client and Gateway resources hold secret references rather than the value. If the client resource is missing, provisioning reuses the stored secret and generates a new one only when Secret-Manager confirms that no value exists. Lookup failures are retried, not treated as permission to generate replacement credentials. A secret stored before a failed client creation is reused on retry.

With Secret-Manager disabled, credentials are kept inline on the client and gateways. Reconciliation still preserves an existing client's secret, but recreating a manually deleted client generates a new one. With Secret-Manager enabled, recreation reuses the stored value instead.

Zone deletion deliberately retains the client and its stored secret; deleting the Client resource would also delete the backing identity-provider client. Run the Admin operator with leader election when using multiple replicas to prevent competing provisioning attempts.

Every named gateway exposes issuer, certificate, and OpenID discovery routes for the default realm and the internal rover realm, plus the team-api realm when configured. These routes cover the hostnames and base paths of all presets using that gateway. World-visible zones add /spacegate after the preset base path.

Admin also creates an owned <gateway>--zone-health passthrough route for every gateway, independent of managed routes and DTC. It covers every preset hostname and base path without /spacegate. Its spec.traffic.healthProbe: true flag tells Gateway to answer HEAD probes with 200 without contacting an upstream. The Route CRD gains this optional boolean; the Zone CRD is unchanged. Shared preflight validation checks the 20-hostname and 10-distinct-path Route limits before creating identity or health routes. Stale-route cleanup removes health routes when their gateway is removed.

Zone admission and reconciliation share aggregation, normalized path construction, and cardinality validation in admin/internal/routeinputs. Create/update admission rejects excessive inputs with field-specific errors; the controller retains a defensive blocked-error check for existing invalid Zones. Fixed identity and health suffixes preserve the number of distinct normalized base paths, so validation does not depend on provisioned realm names or visibility.

Secret onboarding (defaulting webhook)

A Zone defaulting webhook processes a zone's sensitive fields before the resource is stored — the IDP admin password and the Redis password. The gateway admin (rover) client secret is managed separately during Zone provisioning, as described above.

• When Secret-Manager is enabled, the webhook uploads each value to Secret-Manager under a zones/<zone>/admin/... path and replaces the clear-text value in the Zone with a secret reference.
• When Secret-Manager is disabled, the same secrets are generated inline and kept on the resource.

Either way, you can leave a secret field empty to have one generated for you, or set it to the rotate keyword to force a new value. On updates, omitting a secret preserves the existing one, so re-applying a Zone never regenerates secrets by accident.

See Secret Manager Domain for how references are stored and resolved, and Admin Journey: Environments & Zones for the operator-facing guide.

Domain Interactions

• Gateway domain — Zones define which gateway instance is used. The Gateway operator reads the zone's gateway configuration (presets, URLs, features) when provisioning routes. Managed routes (TeamAPI and Proxy) are created directly by the zone handler.
• Identity domain — Zones define which identity provider is used. The Identity operator reads the zone's IDP configuration when provisioning clients and realms. The zone handler creates a default identity realm with token claims (originZone, originStargate, clientId) and the internal rover realm (with the rover gateway admin client) for admin-config clients.
• Organization domain — Teams are created within environments. Zones determine where team resources are provisioned. If a zone has TeamAPI-type managed routes, a team-api identity realm is created for team-facing APIs.
• Event domain — EventConfig resources reference zones for event routing and meshing.
• Secret Manager domain — The Zone defaulting webhook onboards zone secrets (IDP admin password, Redis password) and stores references instead of clear-text values.

Related Pages

• Admin Journey: Environments & Zones
• Architecture Overview