diff --git a/content/en/docs/proxy/reference.md b/content/en/docs/proxy/reference.md index dbdfd61..070258a 100644 --- a/content/en/docs/proxy/reference.md +++ b/content/en/docs/proxy/reference.md @@ -80,9 +80,9 @@ GlobalProxySettingsSpec defines the desired state of GlobalProxySettings. | **Name** | **Type** | **Description** | **Required** | | :---- | :---- | :----------- | :-------- | | **apiGroups** | []string | APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against any resource listed will be allowed. '*' represents all resources. Empty string represents v1 api resources. | true | -| **operations** | []enum | Operations which can be executed on the selected resources.
*Enum*: List, Update, Delete
*Default*: [List]
| true | | **resources** | []string | Resources is a list of resources this rule applies to. '*' represents all resources. | true | | **[selector](#globalproxysettingsspecrulesindexclusterresourcesindexselector)** | object | Select all cluster scoped resources with the given label selector.
Defining a selector which does not match any resources is considered not selectable (eg. using operation NotExists). | true | +| **operations** | []enum | Operations which can be executed on the selected resources.
Deprecated: For all registered Routes only LIST ang GET requests will intercepted
Other permissions must be implemented via kubernetes native RBAC | false | ### GlobalProxySettings.spec.rules[index].clusterResources[index].selector @@ -163,9 +163,9 @@ Resource is Namespace-scoped and applies the settings to the belonged Tenant. | **Name** | **Type** | **Description** | **Required** | | :---- | :---- | :----------- | :-------- | | **apiGroups** | []string | APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against any resource listed will be allowed. '*' represents all resources. Empty string represents v1 api resources. | true | -| **operations** | []enum | Operations which can be executed on the selected resources.
*Enum*: List, Update, Delete
*Default*: [List]
| true | | **resources** | []string | Resources is a list of resources this rule applies to. '*' represents all resources. | true | | **[selector](#proxysettingspecsubjectsindexclusterresourcesindexselector)** | object | Select all cluster scoped resources with the given label selector.
Defining a selector which does not match any resources is considered not selectable (eg. using operation NotExists). | true | +| **operations** | []enum | Operations which can be executed on the selected resources.
Deprecated: For all registered Routes only LIST ang GET requests will intercepted
Other permissions must be implemented via kubernetes native RBAC | false | ### ProxySetting.spec.subjects[index].clusterResources[index].selector @@ -204,5 +204,5 @@ relates the key and values. | **Name** | **Type** | **Description** | **Required** | | :---- | :---- | :----------- | :-------- | | **kind** | enum |
*Enum*: Nodes, StorageClasses, IngressClasses, PriorityClasses, RuntimeClasses, PersistentVolumes
| true | -| **operations** | []enum |
*Enum*: List, Update, Delete
| true | +| **operations** | []enum | | true | diff --git a/content/en/docs/reference.md b/content/en/docs/reference.md index c2f5f52..4e98fcb 100644 --- a/content/en/docs/reference.md +++ b/content/en/docs/reference.md @@ -17,6 +17,10 @@ Resource Types: - [GlobalTenantResource](#globaltenantresource) +- [ResourcePoolClaim](#resourcepoolclaim) + +- [ResourcePool](#resourcepool) + - [TenantResource](#tenantresource) - [Tenant](#tenant) @@ -284,6 +288,232 @@ GlobalTenantResourceStatus defines the observed state of GlobalTenantResource. | **namespace** | string | Namespace of the referent.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ | true | | **apiVersion** | string | API version of the referent. | false | +## ResourcePoolClaim + + + + + + +ResourcePoolClaim is the Schema for the resourcepoolclaims API. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **apiVersion** | string | capsule.clastix.io/v1beta2 | true | +| **kind** | string | ResourcePoolClaim | true | +| **[metadata](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#objectmeta-v1-meta)** | object | Refer to the Kubernetes API documentation for the fields of the `metadata` field. | true | +| **[spec](#resourcepoolclaimspec)** | object | | false | +| **[status](#resourcepoolclaimstatus)** | object | ResourceQuotaClaimStatus defines the observed state of ResourceQuotaClaim. | false | + + +### ResourcePoolClaim.spec + + + + + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **claim** | map[string]int or string | Amount which should be claimed for the resourcequota | true | +| **pool** | string | If there's the possability to claim from multiple global Quotas
You must be specific about which one you want to claim resources from
Once bound to a ResourcePool, this field is immutable | true | + + +### ResourcePoolClaim.status + + + +ResourceQuotaClaimStatus defines the observed state of ResourceQuotaClaim. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **[condition](#resourcepoolclaimstatuscondition)** | object | Condtion for this resource claim | false | +| **[pool](#resourcepoolclaimstatuspool)** | object | Reference to the GlobalQuota being claimed from | false | + + +### ResourcePoolClaim.status.condition + + + +Condtion for this resource claim + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **lastTransitionTime** | string | lastTransitionTime is the last time the condition transitioned from one status to another.
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
*Format*: date-time
| true | +| **message** | string | message is a human readable message indicating details about the transition.
This may be an empty string. | true | +| **reason** | string | reason contains a programmatic identifier indicating the reason for the condition's last transition.
Producers of specific condition types may define expected values and meanings for this field,
and whether the values are considered a guaranteed API.
The value should be a CamelCase string.
This field may not be empty. | true | +| **status** | enum | status of the condition, one of True, False, Unknown.
*Enum*: True, False, Unknown
| true | +| **type** | string | type of condition in CamelCase or in foo.example.com/CamelCase. | true | +| **observedGeneration** | integer | observedGeneration represents the .metadata.generation that the condition was set based upon.
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
*Format*: int64
*Minimum*: 0
| false | + + +### ResourcePoolClaim.status.pool + + + +Reference to the GlobalQuota being claimed from + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **name** | string | Name | false | +| **namespace** | string | Namespace | false | +| **uid** | string | UID of the tracked Tenant to pin point tracking | false | + +## ResourcePool + + + + + + +Resourcepools allows you to define a set of resources as known from ResoureQuotas. The Resourcepools are defined at cluster-scope an should +be administrated by cluster-administrators. However they create an interface, where cluster-administrators can define +from which namespaces resources from a Resourcepool can be claimed. The claiming is done via a namespaced CRD called ResourcePoolClaim. Then +it's up the group of users within these namespaces, to manage the resources they consume per namespace. Each Resourcepool provisions a ResourceQuotainto all the selected namespaces. Then essentially the ResourcePoolClaims, when they can be assigned to the ResourcePool stack resources on top of that +ResourceQuota based on the namspace, where the ResourcePoolClaim was made from. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **apiVersion** | string | capsule.clastix.io/v1beta2 | true | +| **kind** | string | ResourcePool | true | +| **[metadata](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#objectmeta-v1-meta)** | object | Refer to the Kubernetes API documentation for the fields of the `metadata` field. | true | +| **[spec](#resourcepoolspec)** | object | ResourcePoolSpec. | false | +| **[status](#resourcepoolstatus)** | object | GlobalResourceQuotaStatus defines the observed state of GlobalResourceQuota. | false | + + +### ResourcePool.spec + + + +ResourcePoolSpec. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **[quota](#resourcepoolspecquota)** | object | Define the resourcequota served by this resourcepool. | true | +| **[config](#resourcepoolspecconfig)** | object | Additional Configuration
*Default*: map[]
| false | +| **defaults** | map[string]int or string | The Defaults given for each namespace, the default is not counted towards the total allocation
When you use claims it's recommended to provision Defaults as the prevent the scheduling of any resources | false | +| **[selectors](#resourcepoolspecselectorsindex)** | []object | Selector to match the namespaces that should be managed by the GlobalResourceQuota | false | + + +### ResourcePool.spec.quota + + + +Define the resourcequota served by this resourcepool. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **hard** | map[string]int or string | hard is the set of desired hard limits for each named resource.
More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/ | false | +| **[scopeSelector](#resourcepoolspecquotascopeselector)** | object | scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota
but expressed using ScopeSelectorOperator in combination with possible values.
For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched. | false | +| **scopes** | []string | A collection of filters that must match each object tracked by a quota.
If not specified, the quota matches all objects. | false | + + +### ResourcePool.spec.quota.scopeSelector + + + +scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota +but expressed using ScopeSelectorOperator in combination with possible values. +For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **[matchExpressions](#resourcepoolspecquotascopeselectormatchexpressionsindex)** | []object | A list of scope selector requirements by scope of the resources. | false | + + +### ResourcePool.spec.quota.scopeSelector.matchExpressions[index] + + + +A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator +that relates the scope name and values. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **operator** | string | Represents a scope's relationship to a set of values.
Valid operators are In, NotIn, Exists, DoesNotExist. | true | +| **scopeName** | string | The name of the scope that the selector applies to. | true | +| **values** | []string | An array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty.
This array is replaced during a strategic merge patch. | false | + + +### ResourcePool.spec.config + + + +Additional Configuration + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **defaultsZero** | boolean | With this option all resources which can be allocated are set to 0 for the resourcequota defaults.
*Default*: false
| false | +| **deleteBoundResources** | boolean | When a resourcepool is deleted, the resourceclaims bound to it are disassociated from the resourcepool but not deleted.
By Enabling this option, the resourceclaims will be deleted when the resourcepool is deleted, if they are in bound state.
*Default*: false
| false | +| **orderedQueue** | boolean | Claims are queued whenever they are allocated to a pool. A pool tries to allocate claims in order based on their
creation date. But no matter their creation time, if a claim is requesting too much resources it's put into the queue
but if a lower priority claim still has enough space in the available resources, it will be able to claim them. Eventough
it's priority was lower
Enabling this option respects to Order. Meaning the Creationtimestamp matters and if a resource is put into the queue, no
other claim can claim the same resources with lower priority.
*Default*: false
| false | + + +### ResourcePool.spec.selectors[index] + + + +Selector for resources and their labels or selecting origin namespaces + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **[matchExpressions](#resourcepoolspecselectorsindexmatchexpressionsindex)** | []object | matchExpressions is a list of label selector requirements. The requirements are ANDed. | false | +| **matchLabels** | map[string]string | matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed. | false | + + +### ResourcePool.spec.selectors[index].matchExpressions[index] + + + +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **key** | string | key is the label key that the selector applies to. | true | +| **operator** | string | operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist. | true | +| **values** | []string | values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch. | false | + + +### ResourcePool.status + + + +GlobalResourceQuotaStatus defines the observed state of GlobalResourceQuota. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **[allocation](#resourcepoolstatusallocation)** | object | Tracks the Usage from Claimed against what has been granted from the pool | false | +| **claimCount** | integer | Amount of claims
*Default*: 0
| false | +| **[claims](#resourcepoolstatusclaimskeyindex)** | map[string][]object | Tracks the quotas for the Resource. | false | +| **namespaceCount** | integer | How many namespaces are considered
*Default*: 0
| false | +| **namespaces** | []string | Namespaces which are considered for claims | false | + + +### ResourcePool.status.allocation + + + +Tracks the Usage from Claimed against what has been granted from the pool + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **available** | map[string]int or string | Used to track the usage of the resource in the pool (diff hard - claimed). May be used for further automation | false | +| **hard** | map[string]int or string | Hard is the set of enforced hard limits for each named resource.
More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/ | false | +| **used** | map[string]int or string | Used is the current observed total usage of the resource in the namespace. | false | + + +### ResourcePool.status.claims[key][index] + + + +ResourceQuotaClaimStatus defines the observed state of ResourceQuotaClaim. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **claims** | map[string]int or string | Claimed resources | false | +| **name** | string | Name | false | +| **namespace** | string | Namespace | false | +| **uid** | string | UID of the tracked Tenant to pin point tracking | false | + ## TenantResource @@ -466,7 +696,8 @@ TenantSpec defines the desired state of Tenant. | **[containerRegistries](#tenantspeccontainerregistries-1)** | object | Specifies the trusted Image Registries assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed trusted registries. Optional. | false | | **cordoned** | boolean | Toggling the Tenant resources cordoning, when enable resources cannot be deleted.
*Default*: false
| false | | **forceTenantPrefix** | boolean | Use this if you want to disable/enable the Tenant name prefix to specific Tenants, overriding global forceTenantPrefix in CapsuleConfiguration.
When set to 'true', it enforces Namespaces created for this Tenant to be named with the Tenant name prefix,
separated by a dash (i.e. for Tenant 'foo', namespace names must be prefixed with 'foo-'),
this is useful to avoid Namespace name collision.
When set to 'false', it allows Namespaces created for this Tenant to be named anything.
Overrides CapsuleConfiguration global forceTenantPrefix for the Tenant only.
If unset, Tenant uses CapsuleConfiguration's forceTenantPrefix
Optional | false | -| **imagePullPolicies** | []enum | Specify the allowed values for the imagePullPolicies option in Pod resources. Capsule assures that all Pod resources created in the Tenant can use only one of the allowed policy. Optional.
*Enum*: Always, Never, IfNotPresent
| false | +| **[gatewayOptions](#tenantspecgatewayoptions)** | object | Specifies options for the GatewayClass resources. | false | +| **imagePullPolicies** | []enum | Specify the allowed values for the imagePullPolicies option in Pod resources. Capsule assures that all Pod resources created in the Tenant can use only one of the allowed policy. Optional. | false | | **[ingressOptions](#tenantspecingressoptions-1)** | object | Specifies options for the Ingress resources, such as allowed hostnames and IngressClass. Optional. | false | | **[limitRanges](#tenantspeclimitranges-1)** | object | Specifies the resource min/max usage restrictions to the Tenant. The assigned values are inherited by any namespace created in the Tenant. Optional. | false | | **[namespaceOptions](#tenantspecnamespaceoptions-1)** | object | Specifies options for the Namespaces, such as additional metadata or maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional. | false | @@ -504,7 +735,7 @@ TenantSpec defines the desired state of Tenant. | **Name** | **Type** | **Description** | **Required** | | :---- | :---- | :----------- | :-------- | | **kind** | enum |
*Enum*: Nodes, StorageClasses, IngressClasses, PriorityClasses, RuntimeClasses, PersistentVolumes
| true | -| **operations** | []enum |
*Enum*: List, Update, Delete
| true | +| **operations** | []enum | | true | ### Tenant.spec.additionalRoleBindings[index] @@ -546,6 +777,44 @@ Specifies the trusted Image Registries assigned to the Tenant. Capsule assures t | **allowedRegex** | string | | false | +### Tenant.spec.gatewayOptions + + + +Specifies options for the GatewayClass resources. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **[allowedClasses](#tenantspecgatewayoptionsallowedclasses)** | object | | false | + + +### Tenant.spec.gatewayOptions.allowedClasses + + + + + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **default** | string | | false | +| **[matchExpressions](#tenantspecgatewayoptionsallowedclassesmatchexpressionsindex)** | []object | matchExpressions is a list of label selector requirements. The requirements are ANDed. | false | +| **matchLabels** | map[string]string | matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed. | false | + + +### Tenant.spec.gatewayOptions.allowedClasses.matchExpressions[index] + + + +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **key** | string | key is the label key that the selector applies to. | true | +| **operator** | string | operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist. | true | +| **values** | []string | values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch. | false | + + ### Tenant.spec.ingressOptions @@ -651,6 +920,7 @@ Specifies options for the Namespaces, such as additional metadata or maximum num | **Name** | **Type** | **Description** | **Required** | | :---- | :---- | :----------- | :-------- | | **[additionalMetadata](#tenantspecnamespaceoptionsadditionalmetadata-1)** | object | Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant. Optional. | false | +| **[additionalMetadataList](#tenantspecnamespaceoptionsadditionalmetadatalistindex)** | []object | Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant via a list. Optional. | false | | **[forbiddenAnnotations](#tenantspecnamespaceoptionsforbiddenannotations)** | object | Define the annotations that a Tenant Owner cannot set for their Namespace resources. | false | | **[forbiddenLabels](#tenantspecnamespaceoptionsforbiddenlabels)** | object | Define the labels that a Tenant Owner cannot set for their Namespace resources. | false | | **quota** | integer | Specifies the maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional.
*Format*: int32
*Minimum*: 1
| false | @@ -668,6 +938,47 @@ Specifies additional labels and annotations the Capsule operator places on any N | **labels** | map[string]string | | false | +### Tenant.spec.namespaceOptions.additionalMetadataList[index] + + + + + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **annotations** | map[string]string | | false | +| **labels** | map[string]string | | false | +| **[namespaceSelector](#tenantspecnamespaceoptionsadditionalmetadatalistindexnamespaceselector)** | object | A label selector is a label query over a set of resources. The result of matchLabels and
matchExpressions are ANDed. An empty label selector matches all objects. A null
label selector matches no objects. | false | + + +### Tenant.spec.namespaceOptions.additionalMetadataList[index].namespaceSelector + + + +A label selector is a label query over a set of resources. The result of matchLabels and +matchExpressions are ANDed. An empty label selector matches all objects. A null +label selector matches no objects. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **[matchExpressions](#tenantspecnamespaceoptionsadditionalmetadatalistindexnamespaceselectormatchexpressionsindex)** | []object | matchExpressions is a list of label selector requirements. The requirements are ANDed. | false | +| **matchLabels** | map[string]string | matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed. | false | + + +### Tenant.spec.namespaceOptions.additionalMetadataList[index].namespaceSelector.matchExpressions[index] + + + +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values. + +| **Name** | **Type** | **Description** | **Required** | +| :---- | :---- | :----------- | :-------- | +| **key** | string | key is the label key that the selector applies to. | true | +| **operator** | string | operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist. | true | +| **values** | []string | values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch. | false | + + ### Tenant.spec.namespaceOptions.forbiddenAnnotations @@ -1274,7 +1585,7 @@ TenantSpec defines the desired state of Tenant. | **[owners](#tenantspecownersindex)** | []object | Specifies the owners of the Tenant. Mandatory. | true | | **[additionalRoleBindings](#tenantspecadditionalrolebindingsindex)** | []object | Specifies additional RoleBindings assigned to the Tenant. Capsule will ensure that all namespaces in the Tenant always contain the RoleBinding for the given ClusterRole. Optional. | false | | **[containerRegistries](#tenantspeccontainerregistries)** | object | Specifies the trusted Image Registries assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed trusted registries. Optional. | false | -| **imagePullPolicies** | []enum | Specify the allowed values for the imagePullPolicies option in Pod resources. Capsule assures that all Pod resources created in the Tenant can use only one of the allowed policy. Optional.
*Enum*: Always, Never, IfNotPresent
| false | +| **imagePullPolicies** | []enum | Specify the allowed values for the imagePullPolicies option in Pod resources. Capsule assures that all Pod resources created in the Tenant can use only one of the allowed policy. Optional. | false | | **[ingressOptions](#tenantspecingressoptions)** | object | Specifies options for the Ingress resources, such as allowed hostnames and IngressClass. Optional. | false | | **[limitRanges](#tenantspeclimitranges)** | object | Specifies the resource min/max usage restrictions to the Tenant. The assigned values are inherited by any namespace created in the Tenant. Optional. | false | | **[namespaceOptions](#tenantspecnamespaceoptions)** | object | Specifies options for the Namespaces, such as additional metadata or maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional. | false | @@ -1308,7 +1619,7 @@ TenantSpec defines the desired state of Tenant. | **Name** | **Type** | **Description** | **Required** | | :---- | :---- | :----------- | :-------- | | **kind** | enum |
*Enum*: Nodes, StorageClasses, IngressClasses, PriorityClasses
| true | -| **operations** | []enum |
*Enum*: List, Update, Delete
| true | +| **operations** | []enum | | true | ### Tenant.spec.additionalRoleBindings[index]