Namespaces

Tenancy control plane — namespaces, OIDC group bindings, quotas, internal egress targets and machine API keys. Admin only.

postCreate Namespace

Creates a namespace owned by `owner_team` (a team URN, or transitionally a bare slug; platform admins' values are verified against Xeonr Auth and canonicalised to the URN), places it on `cluster_id` (empty: the team's default cluster, else the platform's) and provisions its dedicated runner namespace `cp-rn-<namespace>`. `namespace` must be a DNS-label slug of at most 40 characters. Team admins may not set internal targets or image pull secrets (PermissionDenied). Quotas left at zero default to 4000 mCPU, 8192 MB memory, 16 pods, 50 GiB storage and 20 volumes; a team admin may set them within the team's grant on the cluster (ResourceExhausted beyond it), and a platform admin without limit. Returns AlreadyExists for a taken name. **Access:** a platform admin, or an admin of the `owner_team` team.

postDelete Namespace

Tears down the namespace's runner namespace, deletes the record and revokes every API key owned by or bound to it. Fails with FailedPrecondition while the namespace still has API keys unless `force` is set. **Access:** admin role in the namespace (the owning team's admins, or an ADMIN-role namespace API key), or a platform admin. Other callers get NotFound.

postGet Namespace

Returns a namespace record. A namespace the caller cannot see is reported as NotFound. **Access:** any role in the namespace, or a platform admin.

postIssue API Key

Issues a machine API key owned by this namespace with `role` (UNSPECIFIED means OPERATOR): a Xeonr Auth API key bound to the namespace, and with `workspace_ids` set, confined to those workspaces as well. `expires_at_unix` sets when it stops working (0: never). The plaintext (`xk_…`) is returned once and never again. A key issued before keys moved to Xeonr Auth (`cpk_…`) keeps working unchanged. Keys never carry platform-admin rights. **Access:** admin role in the namespace (the owning team's admins, or an ADMIN-role namespace API key), or a platform admin. Other callers get NotFound.

postList API Keys

Lists a namespace's live API keys (and its revoked ones with `include_revoked`), including its workloads' agent keys (metadata only; plaintext is never returned). `key_id` is the key's Xeonr Auth URN. **Access:** admin role in the namespace (the owning team's admins, or an ADMIN-role namespace API key), or a platform admin. Other callers get NotFound.

postList Namespaces

Lists the namespaces visible to the caller, ordered by name. `page_size` 0 means 100 and is clamped to 1000; `page_token` is the opaque offset from `next_page_token`. **Access:** any authenticated caller; results are filtered to namespaces the caller can read (all of them for a platform admin).

postMove Namespace

Moves a namespace and its persistent volumes to `target_cluster_id`. The controller drains it (refuses new workloads, suspends sandboxes, scales apps to zero, waits up to 15 minutes for running jobs and then cancels them), archives each persistent volume, places the namespace on the target and provisions its runner namespace there, re-seeds each persistent volume from its archive (populated on its first mount on the target; cache and scratch volumes are dropped and rebuilt on use), deletes the source's runner namespace and volumes, and brings apps back to their desired replicas; sandboxes stay suspended until resumed. Progress is `Namespace.move`. A failure before the volumes are re-seeded rolls back to the source, which still has everything. While a move runs, workload operations in the namespace and UpdateNamespace/DeleteNamespace are refused with FailedPrecondition. With `dry_run` nothing starts and the response carries the downtime estimate. The target must be a cluster the namespace's owner team may place on (PermissionDenied otherwise, NotFound if not visible) and CONNECTED (FailedPrecondition). **Access:** a platform admin, or an admin of the namespace's owner team.

postRevoke API Key

Revokes an API key; it is refused within 30 seconds. The key stays in Xeonr Auth's audit trail. Authorisation is checked against the key's own namespace, not anything in the request. `key_id` is the URN ListApiKeys returns; a key id from before keys moved to Xeonr Auth is NotFound. **Access:** admin role in the key's namespace, or a platform admin. Other callers get NotFound.

postUpdate Namespace

Updates a namespace's display name and default limits. Platform admins additionally set quotas, internal targets and image pull secrets (full replace — quotas are written as sent, 0 meaning unlimited) and may adopt or transfer ownership via `owner_team`. For everyone else those fields must be empty/zero or equal to the stored values, otherwise PermissionDenied. Re-reconciles the runner namespace afterwards. **Access:** admin role in the namespace (the owning team's admins, or an ADMIN-role namespace API key), or a platform admin. Other callers get NotFound.