Skip to main content

SFTP Domain

The SFTP domain manages SSH key-based access to the SFTP Service. It translates Kubernetes resources into SFTP Tardis API calls, provisions service users for SFTP instances, and keeps the public keys for those users synchronized from the declared User resources.

Custom Resources​

Instance​

Instance is the Schema for the instances API.

Group: sftp.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

InstanceSpec​

Appears in: Instance

InstanceSpec defines the desired state of Instance.

FieldTypeDefaultValidation
descriptionstring—Optional
sftpServiceConfigRefSftpServiceConfigRef—Required

SftpServiceConfigRef​

Appears in: InstanceSpec, UserSpec

SFTPServiceConfigRef references the SFTPServiceConfig used by this Instance.

FieldTypeDefaultValidation
namestring—Required
namespacestring—Required
uidstring—Optional

InstanceStatus​

Appears in: Instance, SFTPServiceConfig, User

InstanceStatus defines the observed state of Instance.

FieldTypeDefaultValidation
conditionsCondition[]—Optional

Condition​

Appears in: InstanceStatus

FieldTypeDefaultValidation
lastTransitionTimestring—Required, Format: date-time
messagestring—Required, maxLength: 32768
observedGenerationinteger—Optional, Format: int64, minimum: 0
reasonstring—Required, minLength: 1, maxLength: 1024, pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
statusstring—Required, Enum: True \| False \| Unknown
typestring—Required, maxLength: 316, pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

SFTPServiceConfig​

SFTPServiceConfig is the Schema for the sftpserviceconfigs API

Group: sftp.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

SFTPServiceConfigSpec​

Appears in: SFTPServiceConfig

SFTPServiceConfigSpec defines the desired state of SFTPServiceConfig

FieldTypeDefaultValidation
apiAPI—Required

API​

Appears in: SFTPServiceConfigSpec

API contains authentication configuration for API service access.

FieldTypeDefaultValidation
clientIDstring—Required, minLength: 1
clientSecretstring—Required, minLength: 1
endpointstring—Required, Format: uri, minLength: 1
issuerstring—Required, Format: uri, minLength: 1

User​

User is the Schema for the users API

Group: sftp.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

UserSpec​

Appears in: User

UserSpec defines the desired state of User

FieldTypeDefaultValidation
instanceRefSftpServiceConfigRef—Required
sshPublicKeysstring[]—Required, minItems: 1

Resource Model​

SFTP resources follow a simple dependency chain:

  • A SFTPServiceConfig defines the SFTP Tardis API endpoint and OAuth2 client credentials for a zone.
  • An Instance references an SFTPServiceConfig and represents one SFTP service user in the external service.
  • A User references an Instance and contributes one or more SSH public keys to that instance.

Reconciliation Flow​

The SFTPServiceConfig controller validates the configured API credentials by creating or refreshing an SFTP service client. The Instance controller then uses that client to create or update the SFTP service user in the external service.

When User resources change, the Instance controller collects all Users that reference the Instance, canonicalizes their SSH public keys, deduplicates them by fingerprint, and updates the public key set for the SFTP service user. After a successful key sync, the Instance status records the observed per-User Processing condition. The User controller watches those Instance status changes, mirrors the relevant Processing condition onto each User, and derives the User Ready condition from it.

Domain Interactions​

  • Secret Manager — SFTPServiceConfig can resolve SFTP Tardis client secrets from Secret Manager references during reconciliation.
  • SFTP Tardis API — The SFTP operator creates, updates, and deletes SFTP service users and synchronizes their public keys through this external API.