Onboarding

  1. Tenant registers through the API (or via prora)
  2. Grammateus creates a namespace for the tenant and labels it with the tenant identity (see Trust Chain for why this ordering matters)
  3. Grammateus creates a provisioner ServiceAccount and a pruner ServiceAccount in the tenant namespace (see SA Permissions for the permission model)
  4. Tenant configures the platform source handlers, source targets, any necessary credentials with the source handler APIs
  5. Tenant configures their sources with any verifications needed to wire up sending events from their sources to the source handler APIs

All tenant resources — namespace, ServiceAccounts, ClusterRoles, and ClusterRoleBindings from grammateus, source credentials and webhook secrets from source handler APIs, etc. — are labeled with the tenant identity. This allows the pruner to find and prune all tenant resources (including cluster-scoped ones) during offboarding.

This site uses Just the Docs, a documentation theme for Jekyll.