Rover Domain
The Rover domain is the primary user-facing entry point for the Control Plane. Users define their API exposures, subscriptions, and event configurations in a declarative Rover file, and the operator translates them into resources across multiple other domains.
Custom Resources
ApiSpecification
ApiSpecification is the Schema for the apispecifications API
Group: rover.cp.ei.telekom.de · Version: v1 · Scope: Namespaced
ApiSpecificationSpec
Appears in: ApiSpecification
| Field | Type | Default | Validation |
|---|---|---|---|
basepath | string | — | Required, maxLength: 200, pattern: ^/.*$ |
category | string | other | Required |
hash | string | — | Required |
scopes | string[] | — | Optional |
specification | string | — | Required |
version | string | — | Required, pattern: ^\d+.*$ |
xvendor | boolean | false | Optional |
ApiSpecificationStatus
Appears in: ApiSpecification
| Field | Type | Default | Validation |
|---|---|---|---|
api | Api | — | Optional |
conditions | Condition[] | — | Optional |
Api
Appears in: ApiSpecificationStatus, EventSpecificationStatus, RoverStatus
API reference
| Field | Type | Default | Validation |
|---|---|---|---|
name | string | — | Required |
namespace | string | — | Required |
uid | string | — | Optional |
Condition
Appears in: ApiSpecificationStatus, EventSpecificationStatus, RoverStatus
| Field | Type | Default | Validation |
|---|---|---|---|
lastTransitionTime | string | — | Required, Format: date-time |
message | string | — | Required, maxLength: 32768 |
observedGeneration | integer | — | Optional, Format: int64, minimum: 0 |
reason | string | — | Required, minLength: 1, maxLength: 1024, pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ |
status | string | — | Required, Enum: True \| False \| Unknown |
type | string | — | Required, maxLength: 316, pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ |
EventSpecification
EventSpecification is the Schema for the eventspecifications API. It defines an event type's metadata and creates the corresponding EventType singleton in the event domain, analogous to how ApiSpecification creates Api resources.
Group: rover.cp.ei.telekom.de · Version: v1 · Scope: Namespaced
EventSpecificationSpec
Appears in: EventSpecification
EventSpecificationSpec defines the desired state of EventSpecification.
| Field | Type | Default | Validation |
|---|---|---|---|
description | string | — | Optional |
specification | string | — | Optional |
type | string | — | Required, minLength: 1, maxLength: 253, pattern: ^[a-z0-9]+(\.[a-z0-9]+)*$ |
version | string | — | Required, pattern: ^\d+.*$ |
EventSpecificationStatus
Appears in: EventSpecification
EventSpecificationStatus defines the observed state of EventSpecification.
| Field | Type | Default | Validation |
|---|---|---|---|
conditions | Condition[] | — | Optional |
eventType | Api | — | Optional |
Rover
Rover is the Schema for the rovers API Rover resources define API exposures and subscriptions for applications
Group: rover.cp.ei.telekom.de · Version: v1 · Scope: Namespaced
RoverSpec
Appears in: Rover
Spec defines the desired state of the Rover resource
| Field | Type | Default | Validation |
|---|---|---|---|
clientSecret | string | — | Optional |
exposures | Exposures[] | — | Optional |
ipRestrictions | IpRestrictions | — | Optional |
subscriptions | Subscriptions[] | — | Optional |
zone | string | — | Required, minLength: 1 |
Exposures
Appears in: RoverSpec
Exposures is a list of APIs and Events that this Rover exposes to consumers
| Field | Type | Default | Validation |
|---|---|---|---|
api | RoverApi | — | Optional |
event | Event | — | Optional |
RoverApi
Appears in: Exposures
Api defines an API-based service exposure configuration
| Field | Type | Default | Validation |
|---|---|---|---|
approval | Approval | — | Required |
basePath | string | — | Required, pattern: ^/.*$ |
security | Security | — | Optional |
traffic | Traffic | — | Optional |
transformation | Transformation | — | Optional |
upstreams | Upstreams[] | — | Required, minItems: 1, maxItems: 12 |
visibility | string | Enterprise | Required, Enum: World \| Zone \| Enterprise |
Approval
Approval defines the approval workflow required for this API exposure
| Field | Type | Default | Validation |
|---|---|---|---|
strategy | string | Simple | Required, Enum: Auto \| Simple \| FourEyes |
trustedTeams | TrustedTeam[] | — | Optional, minItems: 0, maxItems: 10 |
TrustedTeam
Appears in: Approval
TrustedTeams identifies teams that are trusted for approving this API Per default your own team is trusted
| Field | Type | Default | Validation |
|---|---|---|---|
group | string | — | Required, minLength: 1 |
team | string | — | Required, minLength: 1 |
Security
Appears in: RoverApi
Security defines optional security configuration for this API
| Field | Type | Default | Validation |
|---|---|---|---|
m2m | M2M | — | Optional |
M2M
Appears in: Security
M2M defines machine-to-machine authentication configuration
| Field | Type | Default | Validation |
|---|---|---|---|
basic | Basic | — | Optional |
externalIDP | ExternalIDP | — | Optional |
scopes | string[] | — | Optional, maxItems: 10 |
Basic
Appears in: M2M, ExternalIDP, RoverM2M
Basic defines basic authentication configuration
| Field | Type | Default | Validation |
|---|---|---|---|
password | string | — | Required, minLength: 1 |
username | string | — | Required, minLength: 1 |
ExternalIDP
Appears in: M2M
ExternalIDP defines external identity provider configuration
| Field | Type | Default | Validation |
|---|---|---|---|
basic | Basic | — | Optional |
client | Client | — | Optional |
grantType | string | — | Optional, Enum: client_credentials \| authorization_code \| password |
tokenEndpoint | string | — | Required, Format: uri |
tokenRequest | string | — | Optional, Enum: body \| header |
Client
Appears in: ExternalIDP, RoverM2M
Client defines client credentials for the OAuth2 token request
| Field | Type | Default | Validation |
|---|---|---|---|
clientId | string | — | Optional |
clientKey | string | — | Optional |
clientSecret | string | — | Optional |
Traffic
Appears in: RoverApi
Traffic defines optional traffic management configuration for this API
| Field | Type | Default | Validation |
|---|---|---|---|
circuitBreaker | CircuitBreaker | — | Optional |
failover | Failover | — | Optional |
loadBalancing | LoadBalancing | — | Optional |
rateLimit | RateLimit | — | Optional |
CircuitBreaker
Appears in: Traffic
CircuitBreaker defines the Kong circuit breaker configuration
| Field | Type | Default | Validation |
|---|---|---|---|
enabled | boolean | false | Optional |
Failover
Appears in: Traffic, RoverTraffic
Failover defines disaster recovery configuration for this API
| Field | Type | Default | Validation |
|---|---|---|---|
zones | string[] | — | Optional, maxItems: 10 |
LoadBalancing
Appears in: Traffic
LoadBalancing defines how traffic is distributed among multiple upstream servers
| Field | Type | Default | Validation |
|---|---|---|---|
strategy | string | RoundRobin | Optional, Enum: RoundRobin \| LeastConnections |
RateLimit
Appears in: Traffic
RateLimit defines request rate limiting for this API
| Field | Type | Default | Validation |
|---|---|---|---|
consumers | Consumers | — | Optional |
provider | Provider | — | Optional |
Consumers
Appears in: RateLimit
Consumers defines rate limits applied to API consumers (clients)
| Field | Type | Default | Validation |
|---|---|---|---|
default | Default | — | Optional |
overrides | Overrides[] | — | Optional, maxItems: 10 |
Default
Appears in: Consumers
Default defines the rate limit applied to all consumers not specifically overridden
| Field | Type | Default | Validation |
|---|---|---|---|
limits | Limits | — | Required |
Limits
Appears in: Default, Overrides, Provider
Limits defines the actual rate limit values for different time windows
| Field | Type | Default | Validation |
|---|---|---|---|
hour | integer | — | Optional, minimum: 0 |
minute | integer | — | Optional, minimum: 0 |
second | integer | — | Optional, minimum: 0 |
Overrides
Appears in: Consumers
Overrides defines consumer-specific rate limits
| Field | Type | Default | Validation |
|---|---|---|---|
consumer | string | — | Required, minLength: 1 |
limits | Limits | — | Required |
Provider
Appears in: RateLimit
Provider defines rate limits applied by the API provider (owner)
| Field | Type | Default | Validation |
|---|---|---|---|
limits | Limits | — | Optional |
options | RateLimitOptions | — | Optional |
RateLimitOptions
Appears in: Provider
RateLimitOptions defines additional configuration options for rate limiting
| Field | Type | Default | Validation |
|---|---|---|---|
faultTolerant | boolean | true | Optional |
hideClientHeaders | boolean | false | Optional |
Transformation
Appears in: RoverApi, RoverApi2
Transformation defines optional request/response transformations for this API
| Field | Type | Default | Validation |
|---|---|---|---|
request | Request | — | Optional |
Request
Appears in: Transformation
Request defines transformations applied to incoming API requests
| Field | Type | Default | Validation |
|---|---|---|---|
headers | Headers | — | Optional |
Headers
Appears in: Request
Headers defines HTTP header modifications for requests
| Field | Type | Default | Validation |
|---|---|---|---|
add | string[] | — | Optional, minItems: 1, maxItems: 5 |
remove | string[] | — | Optional, minItems: 1, maxItems: 5 |
Upstreams
Appears in: RoverApi
Upstreams defines the backend service endpoints for this API
| Field | Type | Default | Validation |
|---|---|---|---|
url | string | — | Required, Format: uri |
weight | integer | 1 | Optional, minimum: 1, maximum: 100 |
Event
Appears in: Exposures
Event defines an Event-based service exposure configuration
| Field | Type | Default | Validation |
|---|---|---|---|
additionalPublisherIds | string[] | — | Optional |
approval | Approval | — | Required |
eventType | string | — | Required, minLength: 1 |
scopes | Scopes[] | — | Optional |
visibility | string | Enterprise | Required, Enum: World \| Zone \| Enterprise |
Scopes
Appears in: Event
Scopes defines named scopes with optional publisher-side trigger filtering
| Field | Type | Default | Validation |
|---|---|---|---|
name | string | — | Required, minLength: 1 |
trigger | Trigger | — | Required |
Trigger
Appears in: Scopes, RoverEvent
Trigger defines publisher-side filtering criteria for this scope. Every scope must define a trigger.
| Field | Type | Default | Validation |
|---|---|---|---|
responseFilter | ResponseFilter | — | Optional |
selectionFilter | SelectionFilter | — | Optional |
ResponseFilter
Appears in: Trigger
ResponseFilter controls payload shaping (which fields to return).
| Field | Type | Default | Validation |
|---|---|---|---|
mode | string | Include | Optional, Enum: Include \| Exclude |
paths | string[] | — | Optional |
SelectionFilter
Appears in: Trigger
SelectionFilter controls event matching (which events to deliver).
| Field | Type | Default | Validation |
|---|---|---|---|
attributes | map<string, string> | — | Optional |
expression | object | — | Optional |
IpRestrictions
Appears in: RoverSpec
IpRestrictions defines IP-based access restrictions for the entire Application
| Field | Type | Default | Validation |
|---|---|---|---|
allow | string[] | — | Optional, minItems: 0, maxItems: 10 |
deny | string[] | — | Optional, minItems: 0, maxItems: 10 |
Subscriptions
Appears in: RoverSpec
Subscriptions is a list of APIs and Events that this Rover consumes from providers
| Field | Type | Default | Validation |
|---|---|---|---|
api | RoverApi2 | — | Optional |
event | RoverEvent | — | Optional |
RoverApi2
Appears in: Subscriptions
Api defines an API-based service subscription configuration
| Field | Type | Default | Validation |
|---|---|---|---|
basePath | string | — | Required, pattern: ^/.*$ |
organization | string | — | Optional |
security | RoverSecurity | — | Optional |
traffic | RoverTraffic | — | Optional |
transformation | Transformation | — | Optional |
RoverSecurity
Appears in: RoverApi2
Security defines optional security configuration for this API
| Field | Type | Default | Validation |
|---|---|---|---|
m2m | RoverM2M | — | Optional |
RoverM2M
Appears in: RoverSecurity
M2M defines machine-to-machine authentication configuration
| Field | Type | Default | Validation |
|---|---|---|---|
basic | Basic | — | Optional |
client | Client | — | Optional |
scopes | string[] | — | Optional, maxItems: 10 |
RoverTraffic
Appears in: RoverApi2
Traffic defines optional traffic management configuration for this API
| Field | Type | Default | Validation |
|---|---|---|---|
failover | Failover | — | Optional |
RoverEvent
Appears in: Subscriptions
Event defines an Event-based service subscription configuration
| Field | Type | Default | Validation |
|---|---|---|---|
delivery | Delivery | — | Required |
eventType | string | — | Required, minLength: 1 |
scopes | string[] | — | Optional |
trigger | Trigger | — | Optional |
Delivery
Appears in: RoverEvent
Delivery configures how events are delivered to the subscriber
| Field | Type | Default | Validation |
|---|---|---|---|
callback | string | — | Optional, Format: uri |
circuitBreakerOptOut | boolean | — | Optional |
enforceGetHttpRequestMethodForHealthCheck | boolean | — | Optional |
eventRetentionTime | string | — | Optional, Format: duration |
payload | string | Data | Required, Enum: Data \| DataRef |
redeliveriesPerSecond | integer | — | Optional |
retryableStatusCodes | integer[] | — | Optional |
type | string | Callback | Required, Enum: Callback \| ServerSentEvent |
RoverStatus
Appears in: Rover
Status contains the observed state of the Rover resource
| Field | Type | Default | Validation |
|---|---|---|---|
apiExposures | Api[] | — | Optional |
apiSubscriptions | Api[] | — | Optional |
application | Api | — | Optional |
conditions | Condition[] | — | Optional |
eventExposures | Api[] | — | Optional |
eventSubscriptions | Api[] | — | Optional |
Entry Points
Users interact with the Rover domain through three paths:
| Path | Description |
|---|---|
| Rover-CTL | Command-line tool. Reads a local Rover file and sends it to the Rover Server. |
| Rover Server | REST API. Validates the configuration, uploads specifications to the File Manager, obfuscates secrets through the Secret Manager, and creates the Rover resource in Kubernetes. |
| Direct kubectl | Apply a Rover resource directly to the Kubernetes API (for advanced users or automation). |
Domain Interactions
- Application domain — Creates Application resources.
- API domain — Creates Api, ApiExposure, and ApiSubscription resources.
- Event domain — Creates EventExposure and EventSubscription resources.
- Gateway domain — Configures traffic management settings.
- Identity domain — Configures authentication settings.
- Approval domain — Integrates approval requirements for exposures.