Rover Domain
The Rover domain is the primary user-facing entry point for the Control Plane. Users define their API exposures, subscriptions, and event configurations in a declarative Rover file, and the operator translates them into resources across multiple other domains.
Custom Resources
AgentSpecification
AgentSpecification is the Schema for the agentspecifications API
Group: rover.cp.ei.telekom.de · Version: v1 · Scope: Namespaced
AgentSpecificationSpec
Appears in: AgentSpecification, McpSpecification
| Field | Type | Default | Validation |
|---|---|---|---|
basepath | string | — | Required, maxLength: 200, pattern: ^/.*$ |
category | string | other | Required |
description | string | — | Optional |
hash | string | — | Required |
name | string | — | Required |
scopes | string[] | — | Optional |
specification | string | — | Required |
version | string | — | Required, pattern: ^\d+.*$ |
AgentSpecificationStatus
Appears in: AgentSpecification
| Field | Type | Default | Validation |
|---|---|---|---|
agentCard | AgentCard | — | Optional |
conditions | Condition[] | — | Optional |
AgentCard
Appears in: AgentSpecificationStatus, ApiSpecificationStatus, EventSpecificationStatus, McpSpecificationStatus, RoverStatus
AgentCard reference
| Field | Type | Default | Validation |
|---|---|---|---|
name | string | — | Required |
namespace | string | — | Required |
uid | string | — | Optional |
Condition
Appears in: AgentSpecificationStatus, ApiChangelogStatus, ApiSpecificationStatus, EventSpecificationStatus, McpSpecificationStatus, RoverStatus
| Field | Type | Default | Validation |
|---|---|---|---|
lastTransitionTime | string | — | Required, Format: date-time |
message | string | — | Required, maxLength: 32768 |
observedGeneration | integer | — | Optional, Format: int64, minimum: 0 |
reason | string | — | Required, minLength: 1, maxLength: 1024, pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ |
status | string | — | Required, Enum: True \| False \| Unknown |
type | string | — | Required, maxLength: 316, pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ |
ApiChangelog
ApiChangelog is the Schema for the apichangelogs API The ApiChangelog name is the normalized basePath with major version removed Example: basePath "/eni/my-api/v1" → changelog name "eni-my-api"
Group: rover.cp.ei.telekom.de · Version: v1 · Scope: Namespaced
ApiChangelogSpec
Appears in: ApiChangelog, Roadmap
ApiChangelogSpec defines the desired state of ApiChangelog
| Field | Type | Default | Validation |
|---|---|---|---|
contents | string | — | Required |
hash | string | — | Required |
specificationRef | SpecificationRef | — | Required |
SpecificationRef
Appears in: ApiChangelogSpec
SpecificationRef is a reference to the ApiSpecification this changelog describes The referenced specification may or may not exist yet
| Field | Type | Default | Validation |
|---|---|---|---|
apiVersion | string | — | Optional |
kind | string | — | Optional |
name | string | — | Required |
namespace | string | — | Required |
uid | string | — | Optional |
ApiChangelogStatus
Appears in: ApiChangelog, Roadmap
ApiChangelogStatus defines the observed state of ApiChangelog
| Field | Type | Default | Validation |
|---|---|---|---|
conditions | Condition[] | — | Optional |
ApiSpecification
ApiSpecification is the Schema for the apispecifications API
Group: rover.cp.ei.telekom.de · Version: v1 · Scope: Namespaced
ApiSpecificationSpec
Appears in: ApiSpecification
| Field | Type | Default | Validation |
|---|---|---|---|
basepath | string | — | Required, maxLength: 200, pattern: ^/.*$ |
category | string | other | Required |
hash | string | — | Required |
lint | Lint | — | Optional |
scopes | string[] | — | Optional |
specification | string | — | Required |
version | string | — | Required, pattern: ^\d+.*$ |
xvendor | boolean | false | Optional |
Lint
Appears in: ApiSpecificationSpec
Lint contains the result of the OAS linting performed by rover-server.
| Field | Type | Default | Validation |
|---|---|---|---|
dashboardUrl | string | — | Optional |
message | string | — | Optional |
passed | boolean | — | Required |
ApiSpecificationStatus
Appears in: ApiSpecification
| Field | Type | Default | Validation |
|---|---|---|---|
api | AgentCard | — | Optional |
conditions | Condition[] | — | Optional |
EventSpecification
EventSpecification is the Schema for the eventspecifications API. It defines an event type's metadata and creates the corresponding EventType singleton in the event domain, analogous to how ApiSpecification creates Api resources.
Group: rover.cp.ei.telekom.de · Version: v1 · Scope: Namespaced
EventSpecificationSpec
Appears in: EventSpecification
EventSpecificationSpec defines the desired state of EventSpecification.
| Field | Type | Default | Validation |
|---|---|---|---|
category | string | other | Optional, pattern: ^[a-z]+$ |
description | string | — | Optional |
specification | string | — | Optional |
type | string | — | Required, minLength: 1, maxLength: 253, pattern: ^[a-z0-9]+(\.[a-z0-9]+)*$ |
version | string | — | Required, pattern: ^\d+.*$ |
EventSpecificationStatus
Appears in: EventSpecification
EventSpecificationStatus defines the observed state of EventSpecification.
| Field | Type | Default | Validation |
|---|---|---|---|
conditions | Condition[] | — | Optional |
eventType | AgentCard | — | Optional |
McpSpecification
McpSpecification is the Schema for the mcpspecifications API
Group: rover.cp.ei.telekom.de · Version: v1 · Scope: Namespaced
McpSpecificationStatus
Appears in: McpSpecification
| Field | Type | Default | Validation |
|---|---|---|---|
conditions | Condition[] | — | Optional |
mcpServer | AgentCard | — | Optional |
Roadmap
Roadmap is the Schema for the roadmaps API The Roadmap name is the normalized basePath with major version removed Example: basePath "/eni/my-api/v1" → roadmap name "eni-my-api"
Group: rover.cp.ei.telekom.de · Version: v1 · Scope: Namespaced
Rover
Rover is the Schema for the rovers API Rover resources define API exposures and subscriptions for applications
Group: rover.cp.ei.telekom.de · Version: v1 · Scope: Namespaced
RoverSpec
Appears in: Rover
Spec defines the desired state of the Rover resource
| Field | Type | Default | Validation |
|---|---|---|---|
authentication | Authentication | — | Optional |
clientSecret | string | — | Optional |
exposures | Exposures[] | — | Optional, maxItems: 150 |
externalIds | ExternalId[] | — | Optional, maxItems: 16 |
ipRestrictions | IpRestrictions | — | Optional |
permissions | Permissions[] | — | Optional, maxItems: 150 |
subscriptions | Subscriptions[] | — | Optional, maxItems: 150 |
zone | string | — | Required, minLength: 1 |
Authentication
Appears in: RoverSpec
Authentication defines the authentication configuration for this application
| Field | Type | Default | Validation |
|---|---|---|---|
m2m | M2M | — | Optional |
M2M
Appears in: Authentication
M2M defines machine-to-machine authentication settings for the application
| Field | Type | Default | Validation |
|---|---|---|---|
tokenRequest | string | client_secret_basic | Optional, Enum: client_secret_basic \| client_secret_post |
Exposures
Appears in: RoverSpec
Exposures is a list of APIs and Events that this Rover exposes to consumers
| Field | Type | Default | Validation |
|---|---|---|---|
agentic | Agentic | — | Optional |
api | Api | — | Optional |
event | Event | — | Optional |
Agentic
Appears in: Exposures
Agentic defines an Agentic(MCP or agent) server exposure configuration
| Field | Type | Default | Validation |
|---|---|---|---|
approval | Approval | — | Required |
basePath | string | — | Required, pattern: ^/[a-z0-9-/]+$ |
security | Security | — | Optional |
traffic | Traffic | — | Optional |
transformation | Transformation | — | Optional |
upstreams | Upstreams[] | — | Required, minItems: 1, maxItems: 12 |
variant | string | MCP | Required, Enum: MCP \| TELECONTEXTMCP \| AGENT |
visibility | string | Enterprise | Required, Enum: World \| Zone \| Enterprise |
Approval
Appears in: Agentic, Api, Event
Approval defines the approval workflow for subscriptions to this MCP server
| Field | Type | Default | Validation |
|---|---|---|---|
strategy | string | Simple | Required, Enum: Auto \| Simple \| FourEyes |
trustedTeams | TrustedTeam[] | — | Optional, minItems: 0, maxItems: 10 |
TrustedTeam
Appears in: Approval
TrustedTeams identifies teams that are trusted for approving this API Per default your own team is trusted
| Field | Type | Default | Validation |
|---|---|---|---|
group | string | — | Required, minLength: 1 |
team | string | — | Required, minLength: 1 |
Security
Security defines optional security configuration
| Field | Type | Default | Validation |
|---|---|---|---|
m2m | RoverM2M | — | Optional |
RoverM2M
Appears in: Security
M2M defines machine-to-machine authentication configuration
| Field | Type | Default | Validation |
|---|---|---|---|
basic | Basic | — | Optional |
claims | Claims | — | Optional |
externalIDP | ExternalIDP | — | Optional |
scopes | string[] | — | Optional, maxItems: 10 |
Basic
Appears in: RoverM2M, ExternalIDP, RoverM2M2
Basic defines basic authentication configuration
| Field | Type | Default | Validation |
|---|---|---|---|
password | string | — | Required, minLength: 1, maxLength: 256 |
username | string | — | Required, minLength: 1, maxLength: 256 |
Claims
Appears in: RoverM2M
Claims defines token claims that must be present in the token reaching the upstream. Only valid on the platform-managed LMS token.
| Field | Type | Default | Validation |
|---|---|---|---|
aud | Aud | — | Optional |
Aud
Appears in: Claims
Aud defines the audience claim
| Field | Type | Default | Validation |
|---|---|---|---|
value | string | — | Optional, minLength: 1, maxLength: 256 |
valueFrom | string | — | Optional, Enum: ProviderClientId \| ConsumerClientId \| BasePath |
ExternalIDP
Appears in: RoverM2M
ExternalIDP defines external identity provider configuration
| Field | Type | Default | Validation |
|---|---|---|---|
basic | Basic | — | Optional |
client | Client | — | Optional |
grantType | string | — | Required, Enum: client_credentials \| authorization_code \| password \| refresh_token |
tokenEndpoint | string | — | Required, Format: uri, maxLength: 2048 |
tokenRequest | string | — | Required, Enum: client_secret_basic \| client_secret_post |
Client
Appears in: ExternalIDP, RoverM2M2
Client defines client credentials for the OAuth2 token request
| Field | Type | Default | Validation |
|---|---|---|---|
clientId | string | — | Optional, maxLength: 256 |
clientKey | string | — | Optional, maxLength: 8192 |
clientSecret | string | — | Optional, maxLength: 512 |
refreshToken | string | — | Optional |
Traffic
Traffic defines optional traffic management configuration
| Field | Type | Default | Validation |
|---|---|---|---|
circuitBreaker | CircuitBreaker | — | Optional |
failover | Failover | — | Optional |
loadBalancing | LoadBalancing | — | Optional |
rateLimit | RateLimit | — | Optional |
CircuitBreaker
Appears in: Traffic, RoverTraffic
CircuitBreaker defines the Kong circuit breaker configuration
| Field | Type | Default | Validation |
|---|---|---|---|
enabled | boolean | false | Optional |
Failover
Appears in: Traffic
Failover defines disaster recovery configuration for this API
| Field | Type | Default | Validation |
|---|---|---|---|
zones | string[] | — | Optional, maxItems: 10 |
LoadBalancing
Appears in: Traffic
LoadBalancing defines how traffic is distributed among multiple upstream servers
| Field | Type | Default | Validation |
|---|---|---|---|
strategy | string | RoundRobin | Optional, Enum: RoundRobin \| LeastConnections |
RateLimit
Appears in: Traffic
RateLimit defines request rate limiting for this API
| Field | Type | Default | Validation |
|---|---|---|---|
consumers | Consumers | — | Optional |
provider | Provider | — | Optional |
Consumers
Appears in: RateLimit
Consumers defines rate limits applied to API consumers (clients)
| Field | Type | Default | Validation |
|---|---|---|---|
default | Default | — | Optional |
overrides | Overrides[] | — | Optional, maxItems: 10 |
Default
Appears in: Consumers
Default defines the rate limit applied to all consumers not specifically overridden
| Field | Type | Default | Validation |
|---|---|---|---|
limits | Limits | — | Required |
Limits
Appears in: Default, Overrides, Provider
Limits defines the actual rate limit values for different time windows
| Field | Type | Default | Validation |
|---|---|---|---|
hour | integer | — | Optional, minimum: 0 |
minute | integer | — | Optional, minimum: 0 |
second | integer | — | Optional, minimum: 0 |
Overrides
Appears in: Consumers
Overrides defines consumer-specific rate limits
| Field | Type | Default | Validation |
|---|---|---|---|
consumer | string | — | Required, minLength: 1 |
limits | Limits | — | Required |
Provider
Appears in: RateLimit
Provider defines rate limits applied by the API provider (owner)
| Field | Type | Default | Validation |
|---|---|---|---|
limits | Limits | — | Optional |
options | RateLimitOptions | — | Optional |
RateLimitOptions
Appears in: Provider
RateLimitOptions defines additional configuration options for rate limiting
| Field | Type | Default | Validation |
|---|---|---|---|
faultTolerant | boolean | true | Optional |
hideClientHeaders | boolean | false | Optional |
Transformation
Appears in: Agentic, Api, RoverAgentic, RoverApi
Transformation defines optional request/response transformations
| Field | Type | Default | Validation |
|---|---|---|---|
request | Request | — | Optional |
Request
Appears in: Transformation
Request defines transformations applied to incoming API requests
| Field | Type | Default | Validation |
|---|---|---|---|
headers | Headers | — | Optional |
Headers
Appears in: Request
Headers defines HTTP header modifications for requests
| Field | Type | Default | Validation |
|---|---|---|---|
add | string[] | — | Optional, minItems: 1, maxItems: 5 |
remove | string[] | — | Optional, minItems: 1, maxItems: 5 |
Upstreams
Upstreams defines the backend MCP server endpoints
| Field | Type | Default | Validation |
|---|---|---|---|
url | string | — | Required, Format: uri |
weight | integer | 1 | Optional, minimum: 1, maximum: 100 |
Api
Appears in: Exposures
Api defines an API-based service exposure configuration
| Field | Type | Default | Validation |
|---|---|---|---|
approval | Approval | — | Required |
basePath | string | — | Required, pattern: ^/.*$ |
security | Security | — | Optional |
traffic | Traffic | — | Optional |
transformation | Transformation | — | Optional |
upstreams | Upstreams[] | — | Required, minItems: 1, maxItems: 12 |
visibility | string | Enterprise | Required, Enum: World \| Zone \| Enterprise |
Event
Appears in: Exposures
Event defines an Event-based service exposure configuration
| Field | Type | Default | Validation |
|---|---|---|---|
additionalPublisherIds | string[] | — | Optional |
approval | Approval | — | Required |
eventType | string | — | Required, minLength: 1 |
scopes | Scopes[] | — | Optional |
visibility | string | Enterprise | Required, Enum: World \| Zone \| Enterprise |
Scopes
Appears in: Event
Scopes defines named scopes with optional publisher-side trigger filtering
| Field | Type | Default | Validation |
|---|---|---|---|
name | string | — | Required, minLength: 1 |
trigger | Trigger | — | Required |
Trigger
Appears in: Scopes, RoverEvent
Trigger defines publisher-side filtering criteria for this scope. Every scope must define a trigger.
| Field | Type | Default | Validation |
|---|---|---|---|
responseFilter | ResponseFilter | — | Optional |
selectionFilter | SelectionFilter | — | Optional |
ResponseFilter
Appears in: Trigger
ResponseFilter controls payload shaping (which fields to return).
| Field | Type | Default | Validation |
|---|---|---|---|
mode | string | Include | Optional, Enum: Include \| Exclude |
paths | string[] | — | Optional |
SelectionFilter
Appears in: Trigger
SelectionFilter controls event matching (which events to deliver).
| Field | Type | Default | Validation |
|---|---|---|---|
attributes | map<string, string> | — | Optional |
expression | object | — | Optional |
ExternalId
Appears in: RoverSpec
ExternalIds carries business identifiers (e.g. PSI, ICTO) attached to this Rover. Each entry is tagged with a scheme. Format and presence are validated per-zone via the zone's ExternalIdPolicies.
| Field | Type | Default | Validation |
|---|---|---|---|
id | string | — | Required, minLength: 1, maxLength: 128 |
scheme | string | — | Required, minLength: 1, maxLength: 32, pattern: ^[a-z][a-z0-9]*$ |
IpRestrictions
Appears in: RoverSpec
IpRestrictions defines IP-based access restrictions for the entire Application
| Field | Type | Default | Validation |
|---|---|---|---|
allow | string[] | — | Optional, minItems: 0, maxItems: 10 |
deny | string[] | — | Optional, minItems: 0, maxItems: 10 |
Permissions
Appears in: RoverSpec
Permissions defines role-based access control permissions for this application
| Field | Type | Default | Validation |
|---|---|---|---|
actions | string[] | — | Optional, minItems: 1, maxItems: 50 |
entries | Entry[] | — | Optional, minItems: 1, maxItems: 50 |
resource | string | — | Optional, maxLength: 256 |
role | string | — | Optional, maxLength: 256 |
Entry
Appears in: Permissions
Entries lists role-resource-action tuples (used in resource-oriented and role-oriented formats)
| Field | Type | Default | Validation |
|---|---|---|---|
actions | string[] | — | Required, minItems: 1, maxItems: 50 |
resource | string | — | Optional |
role | string | — | Optional |
Subscriptions
Appears in: RoverSpec
Subscriptions is a list of APIs and Events that this Rover consumes from providers
| Field | Type | Default | Validation |
|---|---|---|---|
agentic | RoverAgentic | — | Optional |
api | RoverApi | — | Optional |
event | RoverEvent | — | Optional |
RoverAgentic
Appears in: Subscriptions
Agentic defines an Agentic(MCP or agent) server subscription configuration
| Field | Type | Default | Validation |
|---|---|---|---|
basePath | string | — | Required, pattern: ^/[a-z0-9-/]+$ |
security | RoverSecurity | — | Optional |
traffic | RoverTraffic | — | Optional |
transformation | Transformation | — | Optional |
RoverSecurity
Appears in: RoverAgentic, RoverApi
Security defines optional security configuration
| Field | Type | Default | Validation |
|---|---|---|---|
m2m | RoverM2M2 | — | Optional |
RoverM2M2
Appears in: RoverSecurity
M2M defines machine-to-machine authentication configuration
| Field | Type | Default | Validation |
|---|---|---|---|
basic | Basic | — | Optional |
client | Client | — | Optional |
scopes | string[] | — | Optional, maxItems: 10 |
RoverTraffic
Appears in: RoverAgentic, RoverApi
Traffic defines optional traffic management configuration
| Field | Type | Default | Validation |
|---|---|---|---|
failover | CircuitBreaker | — | Optional |
RoverApi
Appears in: Subscriptions
Api defines an API-based service subscription configuration
| Field | Type | Default | Validation |
|---|---|---|---|
basePath | string | — | Required, pattern: ^/.*$ |
organization | string | — | Optional |
security | RoverSecurity | — | Optional |
traffic | RoverTraffic | — | Optional |
transformation | Transformation | — | Optional |
RoverEvent
Appears in: Subscriptions
Event defines an Event-based service subscription configuration
| Field | Type | Default | Validation |
|---|---|---|---|
delivery | Delivery | — | Required |
eventType | string | — | Required, minLength: 1 |
scopes | string[] | — | Optional |
trigger | Trigger | — | Optional |
Delivery
Appears in: RoverEvent
Delivery configures how events are delivered to the subscriber
| Field | Type | Default | Validation |
|---|---|---|---|
callback | string | — | Optional, Format: uri |
circuitBreakerOptOut | boolean | — | Optional |
enforceGetHttpRequestMethodForHealthCheck | boolean | — | Optional |
eventRetentionTime | string | — | Optional, Format: duration |
payload | string | Data | Required, Enum: Data \| DataRef |
redeliveriesPerSecond | integer | — | Optional |
retryableStatusCodes | integer[] | — | Optional |
type | string | Callback | Required, Enum: Callback \| ServerSentEvent |
RoverStatus
Appears in: Rover
Status contains the observed state of the Rover resource
| Field | Type | Default | Validation |
|---|---|---|---|
aiExposures | AgentCard[] | — | Optional |
aiSubscriptions | AgentCard[] | — | Optional |
apiExposures | AgentCard[] | — | Optional |
apiSubscriptions | AgentCard[] | — | Optional |
application | AgentCard | — | Optional |
conditions | Condition[] | — | Optional |
eventExposures | AgentCard[] | — | Optional |
eventSubscriptions | AgentCard[] | — | Optional |
permissionSets | AgentCard[] | — | Optional |
Entry Points
Users interact with the Rover domain through three paths:
| Path | Description |
|---|---|
| Rover-CTL | Command-line tool. Reads a local Rover file and sends it to the Rover Server. |
| Rover Server | REST API. Validates the configuration, uploads specifications to the File Manager, obfuscates secrets through the Secret Manager, and creates the Rover resource in Kubernetes. |
| Direct kubectl | Apply a Rover resource directly to the Kubernetes API (for advanced users or automation). |
Domain Interactions
- Application domain — Creates Application resources.
- API domain — Creates Api, ApiExposure, and ApiSubscription resources.
- Event domain — Creates EventExposure and EventSubscription resources.
- Gateway domain — Configures traffic management settings.
- Identity domain — Configures authentication settings.
- Approval domain — Integrates approval requirements for exposures.