Skip to main content

API Reference

This page provides a complete reference of all Custom Resource Definitions (CRDs) and REST APIs exposed by the Control Plane.

Custom Resource Definitions

The Control Plane models its configuration as Kubernetes Custom Resources. Each resource represents a specific concept — an API, a subscription, a gateway route, and so on. Operators watch these resources and reconcile the desired state with the actual infrastructure.

All CRDs share the base domain cp.ei.telekom.de, use API version v1, and are namespace-scoped.

Rover is the primary entry point

Most users do not create these resources directly. Instead, they write a single Rover file that declaratively describes their application's API and event posture. The Rover operator then creates and manages the underlying resources automatically. See the Rover domain for details.

Summary

DomainAPI GroupCRDs
Adminadmin.cp.ei.telekom.de/v13
APIapi.cp.ei.telekom.de/v15
Applicationapplication.cp.ei.telekom.de/v11
Approvalapproval.cp.ei.telekom.de/v12
Eventevent.cp.ei.telekom.de/v14
Gatewaygateway.cp.ei.telekom.de/v15
Identityidentity.cp.ei.telekom.de/v13
Notificationnotification.cp.ei.telekom.de/v13
Organizationorganization.cp.ei.telekom.de/v12
PubSubpubsub.cp.ei.telekom.de/v13
Roverrover.cp.ei.telekom.de/v13
Total34

Admin

API Group: admin.cp.ei.telekom.de/v1 · Architecture →

Platform-wide settings such as environments, zones, and federation.

KindDescription
EnvironmentRepresents a deployment environment — the top-level organizational unit.
ZoneConfigures a deployment zone with identity provider, gateway, and connection settings. Controls visibility (World/Enterprise) and circuit breaker settings.
RemoteOrganizationRepresents a federated remote organization for cross-organization API subscription flows. (Planned feature — not yet fully supported.)

API

API Group: api.cp.ei.telekom.de/v1 · Architecture →

API lifecycle management — definitions, exposures, and subscriptions.

KindDescription
ApiA registered API definition with version, base path, category, and optional OAuth2 scopes.
ApiCategoryDefines an API category with team restrictions, linting configuration, and naming requirements.
ApiExposureDeclares that a team exposes an API at a given base path with visibility, approval strategy, traffic management, and security settings.
ApiSubscriptionRepresents a subscription to an API by a consuming application, with security and failover configuration.
RemoteApiSubscriptionEnables cross-organization API subscriptions between federated organizations.

Application

API Group: application.cp.ei.telekom.de/v1 · Architecture →

Application registration and zone assignment.

KindDescription
ApplicationRepresents a deployed application belonging to a team, with zone configuration, failover zones, and security settings.

Approval

API Group: approval.cp.ei.telekom.de/v1 · Architecture →

Access request approvals with multiple strategies.

KindDescription
ApprovalManages the approval lifecycle for access requests, supporting Auto, Simple, and FourEyes strategies.
ApprovalRequestA specific versioned approval request linked to an Approval, tracking individual decisions.

Event

API Group: event.cp.ei.telekom.de/v1 · Architecture →

Asynchronous event publishing and subscription.

KindDescription
EventConfigPer-zone configuration for the event system with connection settings and mesh topology.
EventTypeRegistry entry for a known event type with a dot-separated identifier and JSON schema.
EventExposureDeclares that an application publishes events of a specific type, with visibility and approval settings.
EventSubscriptionDeclares that an application subscribes to events, with delivery configuration and trigger filters.

Gateway

API Group: gateway.cp.ei.telekom.de/v1 · Architecture →

API gateway instances, routes, and consumer management.

KindDescription
GatewayRepresents a gateway instance with admin API access and connection settings.
RealmRepresents a gateway realm (token issuer scope) with URL and consumer configuration.
RouteDefines a gateway route with upstreams, downstreams, traffic management, and security settings.
ConsumeRouteBinds a consumer to a gateway route with optional security and rate limit configuration.
ConsumerRepresents a gateway consumer identity with optional IP restrictions.

Identity

API Group: identity.cp.ei.telekom.de/v1 · Architecture →

Identity providers, realms, and OAuth2 clients.

KindDescription
IdentityProviderManages an identity provider instance (e.g. Keycloak) with admin access configuration.
RealmRepresents an identity realm within a provider, exposing issuer URLs and admin credentials.
ClientRepresents an OAuth2 client within an identity realm.

Notification

API Group: notification.cp.ei.telekom.de/v1 · Architecture →

Notification delivery across email, webhooks, and messaging platforms.

KindDescription
NotificationTriggers sending a notification using a template, with sender info and channel references.
NotificationChannelConfigures a notification delivery channel — email, MS Teams webhook, or generic webhook.
NotificationTemplateDefines a notification template for a specific purpose and channel type.

Organization

API Group: organization.cp.ei.telekom.de/v1 · Architecture →

Organizational structure — groups and teams.

KindDescription
GroupRepresents an organizational group (top-level tenant) with display name and description.
TeamRepresents a team within a group, with members, email, and optional category.

PubSub

API Group: pubsub.cp.ei.telekom.de/v1 · Architecture →

Low-level event infrastructure resources managed by controllers.

KindDescription
EventStoreConnection details for the event configuration backend, created by the EventConfig controller.
PublisherAn event publisher registration, created by the EventExposure controller.
SubscriberAn event subscription registration with delivery and trigger config, created by the EventSubscription controller.

Rover

API Group: rover.cp.ei.telekom.de/v1 · Architecture →

The primary user-facing interface for declarative application configuration.

KindDescription
RoverThe primary user-facing resource — defines an application's complete API and event posture declaratively.
ApiSpecificationStores an uploaded OpenAPI specification and creates the corresponding Api resource.
EventSpecificationStores event type metadata and creates the corresponding EventType resource.

REST API

In addition to the Kubernetes CRDs, the Control Plane exposes two REST APIs.

ControlPlane API

The ControlPlane API provides a read-only view over the resources managed by the Control Plane. It is primarily used by dashboards and internal tooling to query the current state of environments, APIs, subscriptions, and events without direct Kubernetes access.

Rover Server

The Rover Server is the main REST endpoint for external users. It accepts Rover file submissions, validates configurations, manages file uploads (OpenAPI specs, event schemas), and creates the corresponding Kubernetes resources. The command-line tool Rover-CTL communicates with this API.

For more details on how these components fit together, see the Architecture Overview.