From 23750a4b0be6af78832ae0914df5e60a9caf4ad9 Mon Sep 17 00:00:00 2001 From: Tamal Saha Date: Tue, 14 Jul 2026 14:31:55 +0600 Subject: [PATCH 1/2] docs(platform): consolidate API overview + section index into README Each API group directory carried two near-duplicate landing pages: an _index.md (section intro + page list) and an overview.md (endpoint tables). Merge them into a single README.md per group: - README.md now holds the merged content (intro, endpoint tables, page list); it renders at the section root via `url:` and aliases the old `.../overview/` URL so existing links keep working. - _index.md is reduced to frontmatter only (section/menu metadata). - overview.md is removed (superseded by README.md). At the top level, the High-Level Design overview is folded into the API Reference README, deduplicating the Authentication and API Groups sections into one, and the `.../api/overview/` URL is aliased. Signed-off-by: Tamal Saha --- docs/platform/api/README.md | 154 ++++++++++++++---- docs/platform/api/ace-installer/README.md | 53 ++++++ docs/platform/api/ace-installer/_index.md | 21 --- docs/platform/api/ace-installer/overview.md | 35 ---- docs/platform/api/ace-upgrade/README.md | 59 +++++++ docs/platform/api/ace-upgrade/_index.md | 35 ---- docs/platform/api/ace-upgrade/overview.md | 28 ---- .../administration/{overview.md => README.md} | 34 +++- docs/platform/api/administration/_index.md | 25 --- docs/platform/api/authorization/README.md | 45 +++++ docs/platform/api/authorization/_index.md | 20 --- docs/platform/api/authorization/overview.md | 28 ---- docs/platform/api/billing-dashboard/README.md | 98 +++++++++++ docs/platform/api/billing-dashboard/_index.md | 47 ------ .../api/billing-dashboard/overview.md | 56 ------- .../platform/api/chart-repositories/README.md | 41 +++++ .../platform/api/chart-repositories/_index.md | 19 --- .../api/chart-repositories/overview.md | 25 --- .../{overview.md => README.md} | 33 +++- .../api/client-organizations/_index.md | 24 --- .../{overview.md => README.md} | 30 +++- docs/platform/api/cloud-providers/_index.md | 23 --- .../{overview.md => README.md} | 42 ++++- .../api/cluster-management-v1/_index.md | 33 ---- .../{overview.md => README.md} | 40 ++++- .../api/cluster-management-v2/_index.md | 32 ---- .../{overview.md => README.md} | 48 +++++- .../api/licensing-contracts/_index.md | 39 ----- docs/platform/api/marketplace/README.md | 60 +++++++ docs/platform/api/marketplace/_index.md | 31 ---- docs/platform/api/marketplace/overview.md | 33 ---- docs/platform/api/miscellaneous/README.md | 43 +++++ docs/platform/api/miscellaneous/_index.md | 18 -- docs/platform/api/miscellaneous/overview.md | 28 ---- .../api/monitoring-telemetry/README.md | 62 +++++++ .../api/monitoring-telemetry/_index.md | 30 ---- .../api/monitoring-telemetry/overview.md | 36 ---- .../{overview.md => README.md} | 41 ++++- docs/platform/api/multicluster-ocm/_index.md | 32 ---- .../{overview.md => README.md} | 31 +++- .../api/organizations-teams/_index.md | 23 --- docs/platform/api/overview.md | 133 --------------- docs/platform/api/rancher/README.md | 48 ++++++ docs/platform/api/rancher/_index.md | 24 --- docs/platform/api/rancher/overview.md | 27 --- .../users-settings/{overview.md => README.md} | 34 +++- docs/platform/api/users-settings/_index.md | 25 --- 47 files changed, 909 insertions(+), 1017 deletions(-) create mode 100644 docs/platform/api/ace-installer/README.md delete mode 100644 docs/platform/api/ace-installer/overview.md create mode 100644 docs/platform/api/ace-upgrade/README.md delete mode 100644 docs/platform/api/ace-upgrade/overview.md rename docs/platform/api/administration/{overview.md => README.md} (64%) create mode 100644 docs/platform/api/authorization/README.md delete mode 100644 docs/platform/api/authorization/overview.md create mode 100644 docs/platform/api/billing-dashboard/README.md delete mode 100644 docs/platform/api/billing-dashboard/overview.md create mode 100644 docs/platform/api/chart-repositories/README.md delete mode 100644 docs/platform/api/chart-repositories/overview.md rename docs/platform/api/client-organizations/{overview.md => README.md} (55%) rename docs/platform/api/cloud-providers/{overview.md => README.md} (50%) rename docs/platform/api/cluster-management-v1/{overview.md => README.md} (71%) rename docs/platform/api/cluster-management-v2/{overview.md => README.md} (54%) rename docs/platform/api/licensing-contracts/{overview.md => README.md} (57%) create mode 100644 docs/platform/api/marketplace/README.md delete mode 100644 docs/platform/api/marketplace/overview.md create mode 100644 docs/platform/api/miscellaneous/README.md delete mode 100644 docs/platform/api/miscellaneous/overview.md create mode 100644 docs/platform/api/monitoring-telemetry/README.md delete mode 100644 docs/platform/api/monitoring-telemetry/overview.md rename docs/platform/api/multicluster-ocm/{overview.md => README.md} (53%) rename docs/platform/api/organizations-teams/{overview.md => README.md} (69%) delete mode 100644 docs/platform/api/overview.md create mode 100644 docs/platform/api/rancher/README.md delete mode 100644 docs/platform/api/rancher/overview.md rename docs/platform/api/users-settings/{overview.md => README.md} (76%) diff --git a/docs/platform/api/README.md b/docs/platform/api/README.md index 0fe79ad..e819f24 100644 --- a/docs/platform/api/README.md +++ b/docs/platform/api/README.md @@ -11,18 +11,56 @@ section_menu_id: api url: /docs/platform/{{.version}}/api/ aliases: - /docs/platform/{{.version}}/api/README/ +- /docs/platform/{{.version}}/api/overview/ --- # KubeDB Platform API Reference -Low-level reference for the KubeDB Platform API. Every endpoint lists its HTTP method, path, authentication, path/query -parameters, and request/response shapes so you can implement a client directly -against it. +The **KubeDB Platform API Server** is the backend server of the KubeDB Platform. This page gives you both +the whole-system picture — what the server does, how it is put together, how +requests are authenticated and authorized, and how the pieces fit into typical +flows — and the entry point to the low-level, endpoint-by-endpoint reference. Every +endpoint on the per-group pages lists its HTTP method, path, authentication, +path/query parameters, and request/response shapes so you can implement a client +directly against it. All routes are served under the `/api/v1` prefix unless noted otherwise. The marketplace webhook service is a separate listener rooted at `/marketplace/api/v1`. -## Authentication +A machine-readable [OpenAPI 3.0.3 specification](../api/openapi.yaml) of this API is +also available (`openapi.yaml`) — load it into any OpenAPI tool (Swagger UI, Redoc, +`openapi-generator`) to explore the API or generate a client. A self-contained +Swagger UI viewer (`api.html`, with the spec inlined) is available at the repository +root. + +## Overview + +The KubeDB Platform API Server combines an identity foundation (users, organizations, teams, +authentication) with a multi-cluster Kubernetes management platform providing: + +- **Identity & access management** — users, organizations, teams, fine-grained authorization. +- **Cluster management** — import, provision, and operate Kubernetes clusters (hub/spoke via Open Cluster Management, Rancher, cloud providers). +- **A full Kubernetes API proxy** — the KubeDB Platform UI talks to member clusters through the KubeDB Platform API Server. +- **Licensing & contracts** — issuing and enforcing product licenses (KubeDB, KubeStash, KubeVault, Voyager, ...). +- **Billing & usage reporting** — usage aggregation, invoices, cloud-marketplace metering (AWS/Azure/GCP). +- **Monitoring & telemetry** — telemetry stack provisioning, Prometheus/Trickster auth proxying. + +## System Architecture + +![KubeDB Platform system architecture](../api/images/architecture.svg) + +Key runtime facts: + +- One binary, multiple subcommands. The default command is the API server; `marketplace`, `monitor`, + `aggregator`, and `summary` run as separate processes for async/billing workloads. +- **NATS/JetStream** is the event backbone: member clusters push resource/usage events; `monitor` and + `aggregator` consume them; the API server also uses NATS for its task manager and per-user credentials. +- **FluxCD (HelmRelease)** and **OCM (ManagedCluster)** are used to deploy KubeDB Platform features onto clusters and + to manage hub→spoke relationships. +- Deployment modes are switched by `DEPLOYMENT_TYPE`: AppsCode-hosted, self-hosted (incl. offline + installer), or AWS/GCP marketplace deployments. Some API groups only exist in specific modes (noted below). + +## Authentication & Authorization Most endpoints require a personal access token. Send it as an HTTP header: @@ -35,31 +73,85 @@ endpoints accept HTTP Basic auth. The web console uses a session cookie (`i_like_ace`); a session cookie alone does **not** authenticate the token-guarded REST endpoints — use a token. -A machine-readable [OpenAPI 3.0.3 specification](../api/openapi.yaml) of this API is -also available (`openapi.yaml`) — load it into any OpenAPI tool (Swagger UI, Redoc, -`openapi-generator`) to explore the API or generate a client. A self-contained -Swagger UI viewer (`api.html`, with the spec inlined) is available at the repository -root. +The server supports several authentication mechanisms: + +| Mechanism | Used by | Notes | +|---|---|---| +| Session cookie | Web console | Cookie-based sign-in; CSRF-protected | +| Personal access token / Bearer token | API clients, CLI | `Authorization: token `, `?token=`, `?access_token=` | +| Basic auth | Token management endpoints | With optional OTP (2FA) | +| OAuth2 / OIDC | SSO; the KubeDB Platform API Server is both provider and consumer | `/login/oauth/*`, `/.well-known/openid-configuration` | +| LDAP / PAM | Enterprise sign-in sources | Configured by site admins | +| 2FA / WebAuthn | User accounts | TOTP, scratch tokens, security keys | +| License-based auth | Member clusters | Clusters authenticate with issued licenses / cluster tokens | +| Sudo | Site admins | Impersonate a user via `sudo` param/header | + +Authorization is relationship-based (OpenFGA-style checks, shown as `authzCheck()` in the +reference tables). Common middleware referenced in the API tables: + +- **Token** — authenticated request required (`reqToken`). +- **Site admin** — platform administrator only. +- **Org context** — org resolved from path or `?org=` query; membership/ownership verified. +- **Cluster assignment** — resolves owner+cluster, loads cluster credentials, builds a Kubernetes client. +- **Public** — no authentication beyond baseline middleware. + +Baseline middleware on every `/api/v1` route: optional-sign-in, NATS connection cleanup, +security headers (`nosniff`), API context, sudo support. + +## API Groups + +The v1 API surface is organized into the following logical groups: + +| # | Group | Base path(s) | What it covers | Availability | +|---|-------|--------------|----------------|--------------| +| 1 | [Identity: Users & Settings](../api/users-settings/) | `/api/v1/user`, `/api/v1/users` | Accounts, profile/security settings, tokens, credentials | always | +| 2 | [Identity: Organizations & Teams](../api/organizations-teams/) | `/api/v1/orgs`, `/api/v1/teams` | Orgs, members, teams, org tokens | always | +| 3 | [Administration](../api/administration/) | `/api/v1/admin`, `/api/v1/accounts/admin` | Admin console, site settings | always | +| 4 | [Authorization (Roles & Permissions)](../api/authorization/) | `/api/v1/authz` | Custom roles & permissions | always | +| 5 | [Cluster Management (v1 + K8s proxy + Helm)](../api/cluster-management-v1/) | `/api/v1/clusters` | Cluster lifecycle, Kubernetes proxy, Helm | always | +| 6 | [Cluster Management v2](../api/cluster-management-v2/) | `/api/v1/clustersv2` | Hub-aware cluster API, subscriptions, gateways | always | +| 7 | [Multi-cluster (OCM hub/spoke)](../api/multicluster-ocm/) | `/api/v1/clusters/:owner/:cluster/...` | Hub/spoke, cluster sets, feature sets | always | +| 8 | [Client Organizations](../api/client-organizations/) | `/api/v1/user/client*`, `/api/v1/clusters/.../permission` | Managed-service client orgs | always | +| 9 | [Cloud Providers](../api/cloud-providers/) | `/api/v1/clouds` | Provider discovery for provisioning | always | +| 10 | [Platform Installer](../api/ace-installer/) | `/api/v1/ace-installer` | Self-host installer bundles | AppsCode-hosted only | +| 11 | [Platform Upgrade](../api/ace-upgrade/) | `/api/v1/upgrade`, `/api/v1/clusters/.../upgrade` | Platform & cluster upgrades | always | +| 12 | [Licensing & Contracts](../api/licensing-contracts/) | `/api/v1/contracts`, `/api/v1/user/contracts`, `/api/v1/register`, `/api/v1/license` | Contracts, licenses, registration | contracts: AppsCode-hosted | +| 13 | [Billing Dashboard & Usage Reports](../api/billing-dashboard/) | `/api/v1/dashboard`, `/api/v1/user/dashboard`, `/api/v1/dbaas` | Usage reports & billing dashboards | billing-enabled deployments | +| 14 | [Marketplace](../api/marketplace/) | `/api/v1/marketplaces` (separate service), `/api/v1/proxy/metered-billing` | Cloud-marketplace webhooks & metering | marketplace deployments | +| 15 | [Monitoring & Telemetry](../api/monitoring-telemetry/) | `/api/v1/telemetry`, `/api/v1/trickster` | Telemetry stack, Trickster auth proxy | always | +| 16 | [Rancher Integration](../api/rancher/) | `/api/v1/rancher` | Rancher sync & proxy | always | +| 17 | [Helm Chart Repositories (public)](../api/chart-repositories/) | `/api/v1/chartrepositories` | Public Helm chart repositories | always | +| 18 | [Miscellaneous & Site Settings](../api/miscellaneous/) | `/api/v1/version`, `/api/v1/markdown`, `/api/v1/branding`, ... | Version, markdown, health | always | + +![KubeDB Platform /api/v1 API group map](../api/images/api-groups.svg) + +## Typical Request Flows + +### Cluster resource access via the Kubernetes proxy + +![Kubernetes proxy request flow](../api/images/flow-proxy.svg) + +### License issuance for a contract cluster + +![License issuance flow](../api/images/flow-license.svg) + +### Usage → billing pipeline + +![Usage to billing pipeline](../api/images/flow-billing.svg) + +## Deployment Modes + +| Mode | `DEPLOYMENT_TYPE` | Notes | +|---|---|---| +| AppsCode-hosted (SaaS) | `Hosted` | Full surface incl. contracts admin, installer, Firebase tokens | +| Self-hosted | `SelfHostedProduction` (offline installs also set the separate `OfflineInstaller` flag) | Runs from a generated installer bundle; `/selfhost` console URL | +| AWS Marketplace | `AWSMarketplace` | Marketplace webhooks + AWS metering proxy enabled | +| GCP Marketplace | `GoogleCloudMarketplace` | Marketplace webhooks + GCP metering proxy enabled | +| Azure Marketplace | `AzureMarketplace` | Recognized marketplace mode (webhooks); no metering proxy wired up | + +Feature gating summary: -## API groups - -| Group | What it covers | -|---|---| -| [Identity: Users & Settings](../api/users-settings/public-user-apis/) | Accounts, profile/security settings, tokens, credentials | -| [Identity: Organizations & Teams](../api/organizations-teams/organizations/) | Orgs, members, teams, org tokens | -| [Administration](../api/administration/admin-org/) | Admin console, site settings | -| [Authorization](../api/authorization/roles-permissions/) | Custom roles & permissions | -| [Cluster Management v1](../api/cluster-management-v1/lifecycle/) | Cluster lifecycle, Kubernetes proxy, Helm | -| [Cluster Management v2](../api/cluster-management-v2/clusters/) | Hub-aware cluster API, subscriptions, gateways | -| [Multi-cluster (OCM)](../api/multicluster-ocm/hubs-spokes/) | Hub/spoke, cluster sets, feature sets | -| [Client Organizations](../api/client-organizations/management/) | Managed-service client orgs | -| [Cloud Providers](../api/cloud-providers/cloud-providers/) | Provider discovery for provisioning | -| [Platform Installer](../api/ace-installer/ace-installer/) | Self-host installer bundles | -| [Platform Upgrade](../api/ace-upgrade/platform-upgrade/) | Platform & cluster upgrades | -| [Licensing & Contracts](../api/licensing-contracts/registration/) | Contracts, licenses, registration | -| [Billing Dashboard](../api/billing-dashboard/admin-dashboard/) | Usage reports & billing dashboards | -| [Marketplace](../api/marketplace/webhook-service/) | Cloud-marketplace webhooks & metering | -| [Monitoring & Telemetry](../api/monitoring-telemetry/telemetry-stack/) | Telemetry stack, Trickster auth proxy | -| [Rancher Integration](../api/rancher/rancher/) | Rancher sync & proxy | -| [Chart Repositories](../api/chart-repositories/chart-repositories/) | Public Helm chart repositories | -| [Miscellaneous](../api/miscellaneous/miscellaneous/) | Version, markdown, health | +- `AppsCodeHosted` → contracts admin APIs, installer APIs, org claim, Firebase token. +- `IsBillingEnabled()` → billing dashboard APIs (admin, user, usage reports). +- `DeploymentType` → which marketplace metering proxy (if any) is registered. +- License enforcement is compiled in (`ENFORCE_LICENSE=true`); the server validates its own license at startup. diff --git a/docs/platform/api/ace-installer/README.md b/docs/platform/api/ace-installer/README.md new file mode 100644 index 0000000..c5d64a7 --- /dev/null +++ b/docs/platform/api/ace-installer/README.md @@ -0,0 +1,53 @@ +--- +layout: docs +menu: + docsplatform_{{.version}}: + identifier: api-ace-installer-readme + name: Overview + parent: api-ace-installer + weight: -1 +menu_name: docsplatform_{{.version}} +section_menu_id: api +url: /docs/platform/{{.version}}/api/ace-installer/ +aliases: +- /docs/platform/{{.version}}/api/ace-installer/overview/ +--- + +# Platform Installer API + +The Platform Installer API generates and manages self-host installer bundles for the +KubeDB Platform. It serves the installer options schema, +generates and imports installer bundles, lists and inspects generated installers, +and supports reconfigure/upgrade/versioning and marketplace-installer status. + +> **AppsCode-hosted only.** Every route under `/api/v1/ace-installer/...` is available +> only on the AppsCode-hosted (SaaS) deployment. On self-hosted KubeDB Platform installations these +> routes are not registered and return `404 Not Found`. All calls require a bearer token, +> an org context (resolved from the `org` query param), and per-action authorization +> checks (`view_installers`, `create_installers`, `import_installers`, +> `reconfigure_installers`, `upgrade_installers`, `download_installers`, +> `delete_installers`). + +`/api/v1/ace-installer` (AppsCode-hosted only) + +Generates and manages self-host installer bundles. Token + org context; per-action authz checks. + +| Method | Path | Description | +|--------|------|-------------| +| GET | `/schema.json`, `/model.json` | Installer JSON schema / default options | +| POST | `/generate` | Generate an installer | +| POST | `/import` | Import an installer | +| GET | `/installer-meta`, `/latest-version` | Installer metadata / latest KubeDB Platform version | +| GET | `/installers/` (+`/:name/`, `/:name/:id`) | List / inspect installers | +| DELETE | `/installers/:name/:id` | Delete a generated installer | +| POST | `/installers/:name/:id/{reconfigure,upgrade}` | Reconfigure / upgrade an installer | +| GET | `/installers/:name/:id/versions` | List installer versions | +| GET | `/installers/:name/:id/archives/:archiveName` | Read installer archive details | +| GET | `/installers/:name/:id/model.json` | Installer options | +| GET | `/deployment/marketplace/installers/:installerID/status` | Marketplace installer status | + +## Pages + +- [Platform Installer](../ace-installer.md) — schema/model, generate/import, + installer metadata and latest version, installers CRUD, reconfigure/upgrade, + versions/archives, and marketplace installer status. diff --git a/docs/platform/api/ace-installer/_index.md b/docs/platform/api/ace-installer/_index.md index 5abbd09..3405c19 100644 --- a/docs/platform/api/ace-installer/_index.md +++ b/docs/platform/api/ace-installer/_index.md @@ -9,24 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Platform Installer API - -The Platform Installer API generates and manages self-host installer bundles for the -KubeDB Platform. It serves the installer options schema, -generates and imports installer bundles, lists and inspects generated installers, -and supports reconfigure/upgrade/versioning and marketplace-installer status. - -> **AppsCode-hosted only.** Every route under `/api/v1/ace-installer/...` is available -> only on the AppsCode-hosted (SaaS) deployment. On self-hosted KubeDB Platform installations these -> routes are not registered and return `404 Not Found`. All calls require a bearer token, -> an org context (resolved from the `org` query param), and per-action authorization -> checks (`view_installers`, `create_installers`, `import_installers`, -> `reconfigure_installers`, `upgrade_installers`, `download_installers`, -> `delete_installers`). - -## Pages - -- [Platform Installer](../ace-installer.md) — schema/model, generate/import, - installer metadata and latest version, installers CRUD, reconfigure/upgrade, - versions/archives, and marketplace installer status. diff --git a/docs/platform/api/ace-installer/overview.md b/docs/platform/api/ace-installer/overview.md deleted file mode 100644 index 47c91b2..0000000 --- a/docs/platform/api/ace-installer/overview.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -layout: docs -menu: - docsplatform_{{.version}}: - identifier: api-ace-installer-overview - name: Overview - parent: api-ace-installer - weight: 5 -menu_name: docsplatform_{{.version}} -section_menu_id: api ---- - -# Platform Installer — Overview - -`/api/v1/ace-installer` (AppsCode-hosted only) - -Generates and manages self-host installer bundles. Token + org context; per-action authz checks. - -| Method | Path | Description | -|--------|------|-------------| -| GET | `/schema.json`, `/model.json` | Installer JSON schema / default options | -| POST | `/generate` | Generate an installer | -| POST | `/import` | Import an installer | -| GET | `/installer-meta`, `/latest-version` | Installer metadata / latest KubeDB Platform version | -| GET | `/installers/` (+`/:name/`, `/:name/:id`) | List / inspect installers | -| DELETE | `/installers/:name/:id` | Delete a generated installer | -| POST | `/installers/:name/:id/{reconfigure,upgrade}` | Reconfigure / upgrade an installer | -| GET | `/installers/:name/:id/versions` | List installer versions | -| GET | `/installers/:name/:id/archives/:archiveName` | Read installer archive details | -| GET | `/installers/:name/:id/model.json` | Installer options | -| GET | `/deployment/marketplace/installers/:installerID/status` | Marketplace installer status | - -## Reference pages - -- [installer](../ace-installer.md) diff --git a/docs/platform/api/ace-upgrade/README.md b/docs/platform/api/ace-upgrade/README.md new file mode 100644 index 0000000..a6c111a --- /dev/null +++ b/docs/platform/api/ace-upgrade/README.md @@ -0,0 +1,59 @@ +--- +layout: docs +menu: + docsplatform_{{.version}}: + identifier: api-ace-upgrade-readme + name: Overview + parent: api-ace-upgrade + weight: -1 +menu_name: docsplatform_{{.version}} +section_menu_id: api +url: /docs/platform/{{.version}}/api/ace-upgrade/ +aliases: +- /docs/platform/{{.version}}/api/ace-upgrade/overview/ +--- + +# Platform Upgrade + +APIs for upgrading the KubeDB Platform itself and for upgrading the KubeDB Platform feature +stack running inside imported and spoke clusters. Upgrades are FluxCD/Helm-driven +and run asynchronously; progress and history are tracked in upgrader `ConfigMap` +data, which these endpoints surface as dynamic key/value maps. + +All routes are served under the `/api/v1` prefix. Every endpoint authenticates +with a personal access token sent as `Authorization: token ` (it may +also be supplied as a `token` or `access_token` query parameter). + +There are two distinct authorization models, which is why the endpoints are split +across two pages: + +- **Platform upgrade** routes (`/api/v1/upgrade*`) act on the KubeDB Platform as a + whole. They require an organization context (`?org=`) and **site-admin + organization authorization** — `view_upgrade_history:org` for the read routes + and `upgrade_platform:org` for the trigger route. +- **Cluster upgrade** routes (`/api/v1/clusters/{owner}/{cluster}/upgrade*` and + `.../spoke/upgrade*`) act on a specific member cluster and are gated by + **cluster assignment** for the given owner/cluster (plus a runtime client to + that cluster). + +Platform and per-cluster upgrades (FluxCD-driven). + +| Method | Path | Auth | Description | +|--------|------|------|-------------| +| GET/POST | `/api/v1/upgrade` | Token + org; site-admin authz (view_upgrade_history / upgrade_platform) | Platform upgrade status / trigger | +| GET | `/api/v1/upgrade/{status,history,current-version}` | Token + org; site-admin authz (view_upgrade_history) | Upgrade job status, history, current version | +| GET/POST | `/api/v1/clusters/:owner/:cluster/upgrade` | Cluster assignment + runtime client | Imported-cluster upgrade status / trigger | +| GET | `/api/v1/clusters/:owner/:cluster/upgrade/{history,current-version,latest-version}` | Cluster assignment + runtime client | Upgrade info | +| GET/POST | `/api/v1/clusters/:owner/:cluster/spoke/upgrade` (+`/history`) | Cluster assignment + runtime client | Spoke-cluster upgrade status / trigger / history | + +## Pages + +- [Platform Upgrade](../platform-upgrade.md) — the + `/api/v1/upgrade*` endpoints: platform upgrade status, job status, history, and + current version, plus triggering a platform upgrade. Requires site-admin org + authorization. +- [Cluster Upgrade](../cluster-upgrade.md) — the + `/api/v1/clusters/{owner}/{cluster}/upgrade*` and `.../spoke/upgrade*` + endpoints: imported-cluster and spoke-cluster upgrade status, history, current + and latest versions, plus triggering cluster/spoke upgrades. Gated by cluster + assignment. diff --git a/docs/platform/api/ace-upgrade/_index.md b/docs/platform/api/ace-upgrade/_index.md index 151cef3..54c8a7f 100644 --- a/docs/platform/api/ace-upgrade/_index.md +++ b/docs/platform/api/ace-upgrade/_index.md @@ -9,38 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Platform Upgrade - -APIs for upgrading the KubeDB Platform itself and for upgrading the KubeDB Platform feature -stack running inside imported and spoke clusters. Upgrades are FluxCD/Helm-driven -and run asynchronously; progress and history are tracked in upgrader `ConfigMap` -data, which these endpoints surface as dynamic key/value maps. - -All routes are served under the `/api/v1` prefix. Every endpoint authenticates -with a personal access token sent as `Authorization: token ` (it may -also be supplied as a `token` or `access_token` query parameter). - -There are two distinct authorization models, which is why the endpoints are split -across two pages: - -- **Platform upgrade** routes (`/api/v1/upgrade*`) act on the KubeDB Platform as a - whole. They require an organization context (`?org=`) and **site-admin - organization authorization** — `view_upgrade_history:org` for the read routes - and `upgrade_platform:org` for the trigger route. -- **Cluster upgrade** routes (`/api/v1/clusters/{owner}/{cluster}/upgrade*` and - `.../spoke/upgrade*`) act on a specific member cluster and are gated by - **cluster assignment** for the given owner/cluster (plus a runtime client to - that cluster). - -## Pages - -- [Platform Upgrade](../platform-upgrade.md) — the - `/api/v1/upgrade*` endpoints: platform upgrade status, job status, history, and - current version, plus triggering a platform upgrade. Requires site-admin org - authorization. -- [Cluster Upgrade](../cluster-upgrade.md) — the - `/api/v1/clusters/{owner}/{cluster}/upgrade*` and `.../spoke/upgrade*` - endpoints: imported-cluster and spoke-cluster upgrade status, history, current - and latest versions, plus triggering cluster/spoke upgrades. Gated by cluster - assignment. diff --git a/docs/platform/api/ace-upgrade/overview.md b/docs/platform/api/ace-upgrade/overview.md deleted file mode 100644 index e58d519..0000000 --- a/docs/platform/api/ace-upgrade/overview.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -layout: docs -menu: - docsplatform_{{.version}}: - identifier: api-ace-upgrade-overview - name: Overview - parent: api-ace-upgrade - weight: 5 -menu_name: docsplatform_{{.version}} -section_menu_id: api ---- - -# Platform Upgrade — Overview - -Platform and per-cluster upgrades (FluxCD-driven). - -| Method | Path | Auth | Description | -|--------|------|------|-------------| -| GET/POST | `/api/v1/upgrade` | Token + org; site-admin authz (view_upgrade_history / upgrade_platform) | Platform upgrade status / trigger | -| GET | `/api/v1/upgrade/{status,history,current-version}` | Token + org; site-admin authz (view_upgrade_history) | Upgrade job status, history, current version | -| GET/POST | `/api/v1/clusters/:owner/:cluster/upgrade` | Cluster assignment + runtime client | Imported-cluster upgrade status / trigger | -| GET | `/api/v1/clusters/:owner/:cluster/upgrade/{history,current-version,latest-version}` | Cluster assignment + runtime client | Upgrade info | -| GET/POST | `/api/v1/clusters/:owner/:cluster/spoke/upgrade` (+`/history`) | Cluster assignment + runtime client | Spoke-cluster upgrade status / trigger / history | - -## Reference pages - -- [Platform upgrade](../platform-upgrade.md) -- [Cluster upgrade](../cluster-upgrade.md) diff --git a/docs/platform/api/administration/overview.md b/docs/platform/api/administration/README.md similarity index 64% rename from docs/platform/api/administration/overview.md rename to docs/platform/api/administration/README.md index 974c996..eaedbe6 100644 --- a/docs/platform/api/administration/overview.md +++ b/docs/platform/api/administration/README.md @@ -2,15 +2,35 @@ layout: docs menu: docsplatform_{{.version}}: - identifier: api-administration-overview + identifier: api-administration-readme name: Overview parent: api-administration - weight: 5 + weight: -1 menu_name: docsplatform_{{.version}} section_menu_id: api +url: /docs/platform/{{.version}}/api/administration/ +aliases: +- /docs/platform/{{.version}}/api/administration/overview/ --- -# Administration — Overview +# Administration + +The Administration APIs cover two admin surfaces plus the platform's site-settings +routes. All paths are served under the `/api/v1` prefix. + +- **Administrative-org admin** (`/api/v1/admin/*`) — user and organization management + performed by admins of the platform's administrative organization. +- **Site admin console** (`/api/v1/accounts/admin/*`) — the endpoints powering the + KubeDB Platform site-administration UI: usage analytics, users, organizations, clusters, and + authentication-source management. +- **Site settings** (`/allowed-domains`, `/disable-registration`, `/branding`) — a + small set of global settings whose read endpoints are **public** and whose write + endpoints require site-admin (or org-admin, for branding) authorization. + +Almost every write endpoint (and every admin read endpoint) requires **org context**, +supplied via the `?org=` query parameter, plus a relationship-based +authorization check. The tables on each page state the exact authorization relation +required. Two admin surfaces: the legacy `/admin` group (administrative-org admins) and `/accounts/admin` (site-admin console powering the KubeDB Platform admin UI). Both admin groups require Token + org context + authz checks. @@ -63,8 +83,8 @@ Two admin surfaces: the legacy `/admin` group (administrative-org admins) and `/ | GET | `/branding` | Public | Get branding (logo, app name, colors) | | POST | `/branding` | Org + authzCheck(edit_branding_options) | Update branding | -## Reference pages +## Pages -- [Administrative org](../admin-org.md) -- [Site admin console](../site-admin-console.md) -- [Site settings](../site-settings.md) +- [Administrative-Org Admin](../admin-org.md) — `/api/v1/admin/*`: manage users and their organizations. +- [Site Admin Console](../site-admin-console.md) — `/api/v1/accounts/admin/*`: dashboard, users, orgs, clusters, auth sources. +- [Site Settings](../site-settings.md) — `/allowed-domains`, `/disable-registration`, `/branding`. diff --git a/docs/platform/api/administration/_index.md b/docs/platform/api/administration/_index.md index bc1d51c..4dbe897 100644 --- a/docs/platform/api/administration/_index.md +++ b/docs/platform/api/administration/_index.md @@ -9,28 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Administration - -The Administration APIs cover two admin surfaces plus the platform's site-settings -routes. All paths are served under the `/api/v1` prefix. - -- **Administrative-org admin** (`/api/v1/admin/*`) — user and organization management - performed by admins of the platform's administrative organization. -- **Site admin console** (`/api/v1/accounts/admin/*`) — the endpoints powering the - KubeDB Platform site-administration UI: usage analytics, users, organizations, clusters, and - authentication-source management. -- **Site settings** (`/allowed-domains`, `/disable-registration`, `/branding`) — a - small set of global settings whose read endpoints are **public** and whose write - endpoints require site-admin (or org-admin, for branding) authorization. - -Almost every write endpoint (and every admin read endpoint) requires **org context**, -supplied via the `?org=` query parameter, plus a relationship-based -authorization check. The tables on each page state the exact authorization relation -required. - -## Pages - -- [Administrative-Org Admin](../admin-org.md) — `/api/v1/admin/*`: manage users and their organizations. -- [Site Admin Console](../site-admin-console.md) — `/api/v1/accounts/admin/*`: dashboard, users, orgs, clusters, auth sources. -- [Site Settings](../site-settings.md) — `/allowed-domains`, `/disable-registration`, `/branding`. diff --git a/docs/platform/api/authorization/README.md b/docs/platform/api/authorization/README.md new file mode 100644 index 0000000..7a7227c --- /dev/null +++ b/docs/platform/api/authorization/README.md @@ -0,0 +1,45 @@ +--- +layout: docs +menu: + docsplatform_{{.version}}: + identifier: api-authorization-readme + name: Overview + parent: api-authorization + weight: -1 +menu_name: docsplatform_{{.version}} +section_menu_id: api +url: /docs/platform/{{.version}}/api/authorization/ +aliases: +- /docs/platform/{{.version}}/api/authorization/overview/ +--- + +# Authorization + +The Authorization API exposes the KubeDB Platform's custom role management and permission +inspection, backed by the platform's relationship-based authorization model +(OpenFGA-style checks). It lets you list the permissions the caller holds on a +given object, discover the permissions that can be assigned within an +organization, and create/manage custom roles that bundle permissions and assign +them to teams. + +All endpoints live under the `/api/v1/authz` prefix and require organization +context. That context is **not** taken from the path — it is supplied as a +`?org=` query parameter (for example `?org=appscode`). A valid token +and membership of that organization are required. + +Custom role management backed by the relationship-based authorization model. + +| Method | Path | Auth | Description | +|--------|------|------|-------------| +| GET | `/api/v1/authz/objects/:objectType/:objID/allowed-permissions` | Token + org | Allowed permissions on an object | +| POST | `/api/v1/authz/objects/allowed-permissions` | Token + org | Batch allowed-permissions query | +| GET | `/api/v1/authz/roles/available_permissions` | Token + org | List available permissions | +| GET/POST | `/api/v1/authz/roles` | Token + org (+create_role:org) | List / create roles | +| GET/PUT/DELETE | `/api/v1/authz/roles/:id` | authzCheck(view/edit/delete:role) | Manage a role | +| GET | `/api/v1/authz/roles/:id/principals` | authzCheck(viewer:role) | List principals assigned to a role | + +## Pages + +- [Roles & Permissions](../roles-permissions.md) — object + allowed-permissions lookups (single and batch), the available-permissions + catalog, role CRUD, and role principal listings. diff --git a/docs/platform/api/authorization/_index.md b/docs/platform/api/authorization/_index.md index 34417c5..b5fee1c 100644 --- a/docs/platform/api/authorization/_index.md +++ b/docs/platform/api/authorization/_index.md @@ -9,23 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Authorization - -The Authorization API exposes the KubeDB Platform's custom role management and permission -inspection, backed by the platform's relationship-based authorization model -(OpenFGA-style checks). It lets you list the permissions the caller holds on a -given object, discover the permissions that can be assigned within an -organization, and create/manage custom roles that bundle permissions and assign -them to teams. - -All endpoints live under the `/api/v1/authz` prefix and require organization -context. That context is **not** taken from the path — it is supplied as a -`?org=` query parameter (for example `?org=appscode`). A valid token -and membership of that organization are required. - -## Pages - -- [Roles & Permissions](../roles-permissions.md) — object - allowed-permissions lookups (single and batch), the available-permissions - catalog, role CRUD, and role principal listings. diff --git a/docs/platform/api/authorization/overview.md b/docs/platform/api/authorization/overview.md deleted file mode 100644 index 59807f9..0000000 --- a/docs/platform/api/authorization/overview.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -layout: docs -menu: - docsplatform_{{.version}}: - identifier: api-authorization-overview - name: Overview - parent: api-authorization - weight: 5 -menu_name: docsplatform_{{.version}} -section_menu_id: api ---- - -# Authorization (Roles & Permissions) — Overview - -Custom role management backed by the relationship-based authorization model. - -| Method | Path | Auth | Description | -|--------|------|------|-------------| -| GET | `/api/v1/authz/objects/:objectType/:objID/allowed-permissions` | Token + org | Allowed permissions on an object | -| POST | `/api/v1/authz/objects/allowed-permissions` | Token + org | Batch allowed-permissions query | -| GET | `/api/v1/authz/roles/available_permissions` | Token + org | List available permissions | -| GET/POST | `/api/v1/authz/roles` | Token + org (+create_role:org) | List / create roles | -| GET/PUT/DELETE | `/api/v1/authz/roles/:id` | authzCheck(view/edit/delete:role) | Manage a role | -| GET | `/api/v1/authz/roles/:id/principals` | authzCheck(viewer:role) | List principals assigned to a role | - -## Reference pages - -- [Roles & permissions](../roles-permissions.md) diff --git a/docs/platform/api/billing-dashboard/README.md b/docs/platform/api/billing-dashboard/README.md new file mode 100644 index 0000000..a12f09c --- /dev/null +++ b/docs/platform/api/billing-dashboard/README.md @@ -0,0 +1,98 @@ +--- +layout: docs +menu: + docsplatform_{{.version}}: + identifier: api-billing-dashboard-readme + name: Overview + parent: api-billing-dashboard + weight: -1 +menu_name: docsplatform_{{.version}} +section_menu_id: api +url: /docs/platform/{{.version}}/api/billing-dashboard/ +aliases: +- /docs/platform/{{.version}}/api/billing-dashboard/overview/ +--- + +# Billing Dashboard + +APIs that power the license, usage, and billing screens of the KubeDB Platform web console. +They report on licensed users and their clusters, per-cluster licenses and licensed +products, resource event histories, marketplace subscriptions, system-outage +records, and month-by-month usage summaries (KubeDB, KubeStash, KubeVault, Voyager) +and DBaaS namespace billing reports. + +All routes are served under the `/api/v1` prefix. Every endpoint in this group +authenticates with a personal access token sent as `Authorization: token ` +(it may also be supplied as a `token` or `access_token` query parameter). + +> **Billing-enabled deployments only.** This entire group is registered only when +> the KubeDB Platform API Server runs with billing enabled. On a deployment without billing, all +> of these routes return `404 Not Found` — even with a valid token. The +> owner-scoped and usage-report routes additionally resolve the acting organization +> from the `org` query parameter, so include `?org=` on those calls. + +## Authorization tiers + +Routes in this group fall into three authorization tiers: + +- **Site-admin (licensed users):** the `/dashboard/users/*`, + `/dashboard/clusters/:cid/licenses/active`, `/dashboard/system-outages/*`, and + `/dashboard/marketplaces/*` routes require site-admin authorization + (`view_licensed_users`, `view_system_outages`, or `view_marketplace_usage`). +- **Owner-scoped (`view:contracts`):** the `/dashboard/clusters/*` routes resolve + the owner from `?org=` and require the `view:contracts` permission on that + organization — this is the "self-service" billing dashboard an org sees for its + own clusters. +- **Usage analytics (site-admin):** the `/dashboard/summary/*` usage-report and + download routes require `view_usage_analytics:site_admin`; the `/dbaas/billing/*` + reports require org ownership when an org is set. + +Available on billing-enabled deployments. + +## Site-admin billing dashboard (`/api/v1/dashboard`) + +| Method | Path | Description | +|--------|------|-------------| +| GET | `/users/` (+`/active`, `/inactive`) | Licensed users | +| GET | `/users/:uid/clusters/` (+`/active`, `/:cid/`) | A user's clusters | +| GET | `/users/:uid/clusters/:cid/licenses/` (+`/active`, `/:lid/`) | Licenses per cluster | +| GET | `/users/:uid/clusters/:cid/licenses/:lid/products/` (+`/:productName/`) | Licensed products | +| GET | `.../products/:productName/{resources,events-histories,events/,events/raw-event}` | Product resource history & audit events | +| GET | `/clusters/:cid/licenses/active` | Active licenses for a cluster | +| POST | `/system-outages/`, GET `/system-outages/{report,tags}` | System outage records | +| GET | `/marketplaces/subscriptions`, `/marketplaces/settings/warnings` | Marketplace subscriptions / warnings | +| GET/DELETE | `/marketplaces/:marketplace/:subscriptionId/` (+`/ping`, `/audit-logs`) | Inspect / revoke / ping a subscription | + +## User billing dashboard (`/api/v1/user/dashboard/clusters`, Token) + +| Method | Path | Description | +|--------|------|-------------| +| GET | `/active` | My active clusters | +| GET | `/:cid/` (+`/events-count`) | Cluster info / events count | +| GET | `/:cid/licenses/` (+`/:lid/`) | Licenses | +| GET | `/:cid/licenses/:lid/products/:product/{events-count,events/,events/raw-event}` | License events per product | +| GET | `/:cid/licenses/:lid/products/:product/groups/:group/resources/:resource/:rid/events-count` | Per-resource events count | + +## Usage reports (`/api/v1/dashboard/summary`, `/api/v1/dbaas`) + +| Method | Path | Description | +|--------|------|-------------| +| GET | `/summary/generated-months` | Months with generated usage reports | +| GET | `/summary/object-quota-history/clusters/:clusterUID/objects/:objectID` | Object quota history | +| GET | `/summary/:year/:month/usage-report/products/kubeDb/views/*` | KubeDB usage views (objects, clusters, namespaces, GKS, contracts, quota history, cluster-mode) | +| GET | `/summary/:year/:month/usage-report/products/{kubeStash,kubeVault,voyager}/views/{clusters,contracts}-usage-view` | Usage views per product | +| GET | `/summary/:year/:month/download` | Download PDF usage report | +| GET | `/dbaas/billing/reports/namespaces` (+`/clusters/:clusterID/namespaces/:namespaceName`) | DBaaS billing namespace reports | + +## Pages + +- [Admin Billing Dashboard](../admin-dashboard.md) — the + site-admin `/api/v1/dashboard/*` routes: licensed users, their clusters, + per-cluster licenses and licensed products, resource/event histories, marketplace + subscriptions, and system-outage records. +- [User Billing Dashboard](../user-dashboard.md) — the + owner-scoped `/api/v1/dashboard/clusters/*` routes (`view:contracts`): an + organization's own active clusters, licenses, licensed products, and event counts. +- [Usage Reports](../usage-reports.md) — the + `/api/v1/dashboard/summary/*` monthly usage-report views and PDF download, plus + the `/api/v1/dbaas/billing/*` namespace billing reports. diff --git a/docs/platform/api/billing-dashboard/_index.md b/docs/platform/api/billing-dashboard/_index.md index 801bba3..dea2dda 100644 --- a/docs/platform/api/billing-dashboard/_index.md +++ b/docs/platform/api/billing-dashboard/_index.md @@ -9,50 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Billing Dashboard - -APIs that power the license, usage, and billing screens of the KubeDB Platform web console. -They report on licensed users and their clusters, per-cluster licenses and licensed -products, resource event histories, marketplace subscriptions, system-outage -records, and month-by-month usage summaries (KubeDB, KubeStash, KubeVault, Voyager) -and DBaaS namespace billing reports. - -All routes are served under the `/api/v1` prefix. Every endpoint in this group -authenticates with a personal access token sent as `Authorization: token ` -(it may also be supplied as a `token` or `access_token` query parameter). - -> **Billing-enabled deployments only.** This entire group is registered only when -> the KubeDB Platform API Server runs with billing enabled. On a deployment without billing, all -> of these routes return `404 Not Found` — even with a valid token. The -> owner-scoped and usage-report routes additionally resolve the acting organization -> from the `org` query parameter, so include `?org=` on those calls. - -## Authorization tiers - -Routes in this group fall into three authorization tiers: - -- **Site-admin (licensed users):** the `/dashboard/users/*`, - `/dashboard/clusters/:cid/licenses/active`, `/dashboard/system-outages/*`, and - `/dashboard/marketplaces/*` routes require site-admin authorization - (`view_licensed_users`, `view_system_outages`, or `view_marketplace_usage`). -- **Owner-scoped (`view:contracts`):** the `/dashboard/clusters/*` routes resolve - the owner from `?org=` and require the `view:contracts` permission on that - organization — this is the "self-service" billing dashboard an org sees for its - own clusters. -- **Usage analytics (site-admin):** the `/dashboard/summary/*` usage-report and - download routes require `view_usage_analytics:site_admin`; the `/dbaas/billing/*` - reports require org ownership when an org is set. - -## Pages - -- [Admin Billing Dashboard](../admin-dashboard.md) — the - site-admin `/api/v1/dashboard/*` routes: licensed users, their clusters, - per-cluster licenses and licensed products, resource/event histories, marketplace - subscriptions, and system-outage records. -- [User Billing Dashboard](../user-dashboard.md) — the - owner-scoped `/api/v1/dashboard/clusters/*` routes (`view:contracts`): an - organization's own active clusters, licenses, licensed products, and event counts. -- [Usage Reports](../usage-reports.md) — the - `/api/v1/dashboard/summary/*` monthly usage-report views and PDF download, plus - the `/api/v1/dbaas/billing/*` namespace billing reports. diff --git a/docs/platform/api/billing-dashboard/overview.md b/docs/platform/api/billing-dashboard/overview.md deleted file mode 100644 index 1029c30..0000000 --- a/docs/platform/api/billing-dashboard/overview.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -layout: docs -menu: - docsplatform_{{.version}}: - identifier: api-billing-dashboard-overview - name: Overview - parent: api-billing-dashboard - weight: 5 -menu_name: docsplatform_{{.version}} -section_menu_id: api ---- - -# Billing Dashboard & Usage Reports — Overview - -Available on billing-enabled deployments. - -## Site-admin billing dashboard (`/api/v1/dashboard`) - -| Method | Path | Description | -|--------|------|-------------| -| GET | `/users/` (+`/active`, `/inactive`) | Licensed users | -| GET | `/users/:uid/clusters/` (+`/active`, `/:cid/`) | A user's clusters | -| GET | `/users/:uid/clusters/:cid/licenses/` (+`/active`, `/:lid/`) | Licenses per cluster | -| GET | `/users/:uid/clusters/:cid/licenses/:lid/products/` (+`/:productName/`) | Licensed products | -| GET | `.../products/:productName/{resources,events-histories,events/,events/raw-event}` | Product resource history & audit events | -| GET | `/clusters/:cid/licenses/active` | Active licenses for a cluster | -| POST | `/system-outages/`, GET `/system-outages/{report,tags}` | System outage records | -| GET | `/marketplaces/subscriptions`, `/marketplaces/settings/warnings` | Marketplace subscriptions / warnings | -| GET/DELETE | `/marketplaces/:marketplace/:subscriptionId/` (+`/ping`, `/audit-logs`) | Inspect / revoke / ping a subscription | - -## User billing dashboard (`/api/v1/user/dashboard/clusters`, Token) - -| Method | Path | Description | -|--------|------|-------------| -| GET | `/active` | My active clusters | -| GET | `/:cid/` (+`/events-count`) | Cluster info / events count | -| GET | `/:cid/licenses/` (+`/:lid/`) | Licenses | -| GET | `/:cid/licenses/:lid/products/:product/{events-count,events/,events/raw-event}` | License events per product | -| GET | `/:cid/licenses/:lid/products/:product/groups/:group/resources/:resource/:rid/events-count` | Per-resource events count | - -## Usage reports (`/api/v1/dashboard/summary`, `/api/v1/dbaas`) - -| Method | Path | Description | -|--------|------|-------------| -| GET | `/summary/generated-months` | Months with generated usage reports | -| GET | `/summary/object-quota-history/clusters/:clusterUID/objects/:objectID` | Object quota history | -| GET | `/summary/:year/:month/usage-report/products/kubeDb/views/*` | KubeDB usage views (objects, clusters, namespaces, GKS, contracts, quota history, cluster-mode) | -| GET | `/summary/:year/:month/usage-report/products/{kubeStash,kubeVault,voyager}/views/{clusters,contracts}-usage-view` | Usage views per product | -| GET | `/summary/:year/:month/download` | Download PDF usage report | -| GET | `/dbaas/billing/reports/namespaces` (+`/clusters/:clusterID/namespaces/:namespaceName`) | DBaaS billing namespace reports | - -## Reference pages - -- [Admin dashboard](../admin-dashboard.md) -- [User dashboard](../user-dashboard.md) -- [Usage reports](../usage-reports.md) diff --git a/docs/platform/api/chart-repositories/README.md b/docs/platform/api/chart-repositories/README.md new file mode 100644 index 0000000..a3e6b3f --- /dev/null +++ b/docs/platform/api/chart-repositories/README.md @@ -0,0 +1,41 @@ +--- +layout: docs +menu: + docsplatform_{{.version}}: + identifier: api-chart-repositories-readme + name: Overview + parent: api-chart-repositories + weight: -1 +menu_name: docsplatform_{{.version}} +section_menu_id: api +url: /docs/platform/{{.version}}/api/chart-repositories/ +aliases: +- /docs/platform/{{.version}}/api/chart-repositories/overview/ +--- + +# Chart Repositories + +The Chart Repositories API exposes the KubeDB Platform's read-only view over the public Helm Hub +chart repository index. It lets you enumerate the known Helm chart repositories, +load an individual repository and list the charts it contains, and inspect the +available versions of a specific chart. + +All endpoints live under the `/api/v1/chartrepositories` prefix and are +**public** — they carry no `security` requirement in the API definition and can +be called without organization context. In practice clients still send their +bearer token on every request (the platform accepts it), but no membership or +role is required. Only `GET` requests are exposed here. + +`/api/v1/chartrepositories` + +| Method | Path | Description | +|--------|------|-------------| +| GET | `/` | List chart repositories | +| GET | `/charts` | List charts | +| GET | `/charts/:name/versions` | List versions of a chart | + +## Pages + +- [Chart Repositories](../chart-repositories.md) — list the + known chart repositories, list the charts inside a repository, and list the + versions of a named chart. diff --git a/docs/platform/api/chart-repositories/_index.md b/docs/platform/api/chart-repositories/_index.md index f4b2ca0..a0d9a66 100644 --- a/docs/platform/api/chart-repositories/_index.md +++ b/docs/platform/api/chart-repositories/_index.md @@ -9,22 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Chart Repositories - -The Chart Repositories API exposes the KubeDB Platform's read-only view over the public Helm Hub -chart repository index. It lets you enumerate the known Helm chart repositories, -load an individual repository and list the charts it contains, and inspect the -available versions of a specific chart. - -All endpoints live under the `/api/v1/chartrepositories` prefix and are -**public** — they carry no `security` requirement in the API definition and can -be called without organization context. In practice clients still send their -bearer token on every request (the platform accepts it), but no membership or -role is required. Only `GET` requests are exposed here. - -## Pages - -- [Chart Repositories](../chart-repositories.md) — list the - known chart repositories, list the charts inside a repository, and list the - versions of a named chart. diff --git a/docs/platform/api/chart-repositories/overview.md b/docs/platform/api/chart-repositories/overview.md deleted file mode 100644 index 3455054..0000000 --- a/docs/platform/api/chart-repositories/overview.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -layout: docs -menu: - docsplatform_{{.version}}: - identifier: api-chart-repositories-overview - name: Overview - parent: api-chart-repositories - weight: 5 -menu_name: docsplatform_{{.version}} -section_menu_id: api ---- - -# Helm Chart Repositories (public) — Overview - -`/api/v1/chartrepositories` - -| Method | Path | Description | -|--------|------|-------------| -| GET | `/` | List chart repositories | -| GET | `/charts` | List charts | -| GET | `/charts/:name/versions` | List versions of a chart | - -## Reference pages - -- [Chart repositories](../chart-repositories.md) diff --git a/docs/platform/api/client-organizations/overview.md b/docs/platform/api/client-organizations/README.md similarity index 55% rename from docs/platform/api/client-organizations/overview.md rename to docs/platform/api/client-organizations/README.md index 7f87001..501220a 100644 --- a/docs/platform/api/client-organizations/overview.md +++ b/docs/platform/api/client-organizations/README.md @@ -2,15 +2,40 @@ layout: docs menu: docsplatform_{{.version}}: - identifier: api-client-organizations-overview + identifier: api-client-organizations-readme name: Overview parent: api-client-organizations - weight: 5 + weight: -1 menu_name: docsplatform_{{.version}} section_menu_id: api +url: /docs/platform/{{.version}}/api/client-organizations/ +aliases: +- /docs/platform/{{.version}}/api/client-organizations/overview/ --- -# Client Organizations — Overview +# Client Organizations + +These endpoints support the **managed-service-provider** model. A platform site +admin creates dedicated "client organizations" (a specialized kind of KubeDB Platform +organization), imports spoke clusters into them, and then manages per-cluster +user access on behalf of each client. + +There are two concerns, split across two pages: + +- [Client Org Management](../management.md) — site-admin + lifecycle of client organizations: list/get/create/delete client orgs, add or + remove clusters, and query client-org status. Routes live under + `/api/v1/user/client*`. +- [Cluster User Permissions](../cluster-user-permissions.md) + — organization-admin management of the OCM users belonging to a client org on + a specific cluster: list users, create a user with permissions, inspect and + update permissions, generate a kubeconfig, and remove a user. Routes live + under `/api/v1/clusters/{owner}/{cluster}/permission/*`. + +All routes are served under the `/api/v1` prefix and require a personal access +token (`Authorization: token `). Client-org **management** routes are +site-admin only; the per-cluster **permission** routes require organization-admin +authorization on the `owner` (which must resolve to a client organization). For managed-service providers: site admins create "client orgs" and manage per-cluster user access. @@ -29,7 +54,7 @@ For managed-service providers: site admins create "client orgs" and manage per-c | POST | `/api/v1/clusters/:owner/:cluster/permission/user/:id/{remove,update}` | Org-admin authz | Manage permissions | | DELETE | `/api/v1/clusters/:owner/:cluster/permission/user/:id/delete` | Org-admin authz | Delete the OCM user | -## Reference pages +## Pages - [Management](../management.md) - [Cluster user permissions](../cluster-user-permissions.md) diff --git a/docs/platform/api/client-organizations/_index.md b/docs/platform/api/client-organizations/_index.md index 6f7ab97..44c43c0 100644 --- a/docs/platform/api/client-organizations/_index.md +++ b/docs/platform/api/client-organizations/_index.md @@ -9,27 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Client Organizations - -These endpoints support the **managed-service-provider** model. A platform site -admin creates dedicated "client organizations" (a specialized kind of KubeDB Platform -organization), imports spoke clusters into them, and then manages per-cluster -user access on behalf of each client. - -There are two concerns, split across two pages: - -- [Client Org Management](../management.md) — site-admin - lifecycle of client organizations: list/get/create/delete client orgs, add or - remove clusters, and query client-org status. Routes live under - `/api/v1/user/client*`. -- [Cluster User Permissions](../cluster-user-permissions.md) - — organization-admin management of the OCM users belonging to a client org on - a specific cluster: list users, create a user with permissions, inspect and - update permissions, generate a kubeconfig, and remove a user. Routes live - under `/api/v1/clusters/{owner}/{cluster}/permission/*`. - -All routes are served under the `/api/v1` prefix and require a personal access -token (`Authorization: token `). Client-org **management** routes are -site-admin only; the per-cluster **permission** routes require organization-admin -authorization on the `owner` (which must resolve to a client organization). diff --git a/docs/platform/api/cloud-providers/overview.md b/docs/platform/api/cloud-providers/README.md similarity index 50% rename from docs/platform/api/cloud-providers/overview.md rename to docs/platform/api/cloud-providers/README.md index b44cccf..7b50611 100644 --- a/docs/platform/api/cloud-providers/overview.md +++ b/docs/platform/api/cloud-providers/README.md @@ -2,15 +2,33 @@ layout: docs menu: docsplatform_{{.version}}: - identifier: api-cloud-providers-overview + identifier: api-cloud-providers-readme name: Overview parent: api-cloud-providers - weight: 5 + weight: -1 menu_name: docsplatform_{{.version}} section_menu_id: api +url: /docs/platform/{{.version}}/api/cloud-providers/ +aliases: +- /docs/platform/{{.version}}/api/cloud-providers/overview/ --- -# Cloud Providers — Overview +# Cloud Providers + +Discovery APIs used by the cluster-provisioning wizard. Given stored cloud +credentials for an owner (organization or user), these endpoints enumerate the +projects, regions, zones, Kubernetes versions, machine types, and existing +managed clusters available on each supported cloud provider — so the console can +offer them as choices when provisioning or importing a cluster. A single public +endpoint lists the providers the platform supports, and a provisioning endpoint +creates a new Cluster API (CAPI) cluster on a provider. + +All routes are served under the `/api/v1` prefix. Except for the public provider +list (`GET /clouds`), every endpoint requires a personal access token sent as +`Authorization: token ` (it may also be supplied as a `token` or +`access_token` query parameter). The per-provider discovery routes additionally +require **stored cloud credentials** for the referenced provider under the owner +scope; without a matching credential these routes fail. `/api/v1/clouds` @@ -30,6 +48,8 @@ cloud credentials. | GET | `/:owner/providers/hetzner/{servers,kubernetesversions,regions}` (+ per-region `servers`) | Hetzner discovery | | GET | `/:owner/providers/kubevirt/kubernetesversions` | KubeVirt versions | -## Reference pages +## Pages -- [Cloud providers](../cloud-providers.md) +- [Cloud Providers](../cloud-providers.md) — the public provider + list, CAPI cluster provisioning, and per-provider discovery for GKE, AKS, EKS, + DigitalOcean, Linode, Rancher, Hetzner, and KubeVirt. diff --git a/docs/platform/api/cloud-providers/_index.md b/docs/platform/api/cloud-providers/_index.md index aed604b..9a24038 100644 --- a/docs/platform/api/cloud-providers/_index.md +++ b/docs/platform/api/cloud-providers/_index.md @@ -9,26 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Cloud Providers - -Discovery APIs used by the cluster-provisioning wizard. Given stored cloud -credentials for an owner (organization or user), these endpoints enumerate the -projects, regions, zones, Kubernetes versions, machine types, and existing -managed clusters available on each supported cloud provider — so the console can -offer them as choices when provisioning or importing a cluster. A single public -endpoint lists the providers the platform supports, and a provisioning endpoint -creates a new Cluster API (CAPI) cluster on a provider. - -All routes are served under the `/api/v1` prefix. Except for the public provider -list (`GET /clouds`), every endpoint requires a personal access token sent as -`Authorization: token ` (it may also be supplied as a `token` or -`access_token` query parameter). The per-provider discovery routes additionally -require **stored cloud credentials** for the referenced provider under the owner -scope; without a matching credential these routes fail. - -## Pages - -- [Cloud Providers](../cloud-providers.md) — the public provider - list, CAPI cluster provisioning, and per-provider discovery for GKE, AKS, EKS, - DigitalOcean, Linode, Rancher, Hetzner, and KubeVirt. diff --git a/docs/platform/api/cluster-management-v1/overview.md b/docs/platform/api/cluster-management-v1/README.md similarity index 71% rename from docs/platform/api/cluster-management-v1/overview.md rename to docs/platform/api/cluster-management-v1/README.md index 1928154..56f3d46 100644 --- a/docs/platform/api/cluster-management-v1/overview.md +++ b/docs/platform/api/cluster-management-v1/README.md @@ -2,15 +2,34 @@ layout: docs menu: docsplatform_{{.version}}: - identifier: api-cluster-management-v1-overview + identifier: api-cluster-management-v1-readme name: Overview parent: api-cluster-management-v1 - weight: 5 + weight: -1 menu_name: docsplatform_{{.version}} section_menu_id: api +url: /docs/platform/{{.version}}/api/cluster-management-v1/ +aliases: +- /docs/platform/{{.version}}/api/cluster-management-v1/overview/ --- -# Cluster Management (v1) — Overview +# Cluster Management v1 + +The core cluster API. Every endpoint is scoped to a single cluster identified by +`{owner}` (the organization slug or username that owns the cluster) and `{cluster}` +(the cluster name), and is served under: + +``` +/api/v1/clusters/{owner}/{cluster}/... +``` + +All routes require a personal access token sent as +`Authorization: token ` (it may also be supplied as a `token` or +`access_token` query parameter). Cluster routes additionally resolve the cluster's +stored credentials and build a Kubernetes client for it ("cluster assignment"); a +few routes layer on extra authorization checks, which are called out per endpoint. + +This group covers three related surfaces: `/api/v1/clusters/:owner/:cluster` @@ -78,8 +97,17 @@ Generic passthrough for any group/version/resource, powering the KubeDB Platform | PUT/DELETE | `/helm/editor/` | Apply (install/update) / delete resources via the editor | | PUT | `/helm/editor/{model,manifest,resources}` | Load editor state from an existing install | -## Reference pages +## Pages -- [Lifecycle & info](../lifecycle.md) -- [Kubernetes API proxy](../kubernetes-proxy.md) -- [Helm](../helm.md) +- [Cluster Lifecycle & Info](../lifecycle.md) — get, update, and + delete a cluster; fetch its kubeconfig; discover available resource types; database + status/bundle; feature values; execute whitelisted commands; create resources; + install/uninstall deploy orders; and read resource history. +- [Kubernetes Proxy](../kubernetes-proxy.md) — the generic + `/proxy/*` passthrough for any Kubernetes group/version/resource (CRUD, status, + events, controller, scale, HPAs), plus pod logs/exec, node/pod metrics, access + reviews, the `meta.k8s.appscode.com` render endpoints, scanner/policy reports, and + batch delete. +- [Helm](../helm.md) — Helm console (tiller) configuration, Helm + v3 release management (list/install/upgrade/uninstall/rollback, content, status, + history), bundle/package views, and the resource editor. diff --git a/docs/platform/api/cluster-management-v1/_index.md b/docs/platform/api/cluster-management-v1/_index.md index 2b8d36b..a4e7590 100644 --- a/docs/platform/api/cluster-management-v1/_index.md +++ b/docs/platform/api/cluster-management-v1/_index.md @@ -9,36 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Cluster Management v1 - -The core cluster API. Every endpoint is scoped to a single cluster identified by -`{owner}` (the organization slug or username that owns the cluster) and `{cluster}` -(the cluster name), and is served under: - -``` -/api/v1/clusters/{owner}/{cluster}/... -``` - -All routes require a personal access token sent as -`Authorization: token ` (it may also be supplied as a `token` or -`access_token` query parameter). Cluster routes additionally resolve the cluster's -stored credentials and build a Kubernetes client for it ("cluster assignment"); a -few routes layer on extra authorization checks, which are called out per endpoint. - -This group covers three related surfaces: - -## Pages - -- [Cluster Lifecycle & Info](../lifecycle.md) — get, update, and - delete a cluster; fetch its kubeconfig; discover available resource types; database - status/bundle; feature values; execute whitelisted commands; create resources; - install/uninstall deploy orders; and read resource history. -- [Kubernetes Proxy](../kubernetes-proxy.md) — the generic - `/proxy/*` passthrough for any Kubernetes group/version/resource (CRUD, status, - events, controller, scale, HPAs), plus pod logs/exec, node/pod metrics, access - reviews, the `meta.k8s.appscode.com` render endpoints, scanner/policy reports, and - batch delete. -- [Helm](../helm.md) — Helm console (tiller) configuration, Helm - v3 release management (list/install/upgrade/uninstall/rollback, content, status, - history), bundle/package views, and the resource editor. diff --git a/docs/platform/api/cluster-management-v2/overview.md b/docs/platform/api/cluster-management-v2/README.md similarity index 54% rename from docs/platform/api/cluster-management-v2/overview.md rename to docs/platform/api/cluster-management-v2/README.md index 50d8c98..8562618 100644 --- a/docs/platform/api/cluster-management-v2/overview.md +++ b/docs/platform/api/cluster-management-v2/README.md @@ -2,15 +2,40 @@ layout: docs menu: docsplatform_{{.version}}: - identifier: api-cluster-management-v2-overview + identifier: api-cluster-management-v2-readme name: Overview parent: api-cluster-management-v2 - weight: 5 + weight: -1 menu_name: docsplatform_{{.version}} section_menu_id: api +url: /docs/platform/{{.version}}/api/cluster-management-v2/ +aliases: +- /docs/platform/{{.version}}/api/cluster-management-v2/overview/ --- -# Cluster Management v2 — Overview +# Cluster Management v2 + +The Cluster Management v2 API is the newer, hub-aware cluster surface served under +`/api/v1/clustersv2`. It builds on [Cluster Management v1](../../cluster-management-v1/) +and adds: + +- **Hub awareness** — list hub clusters, resolve hub connection info, and check hub + presence for an owner (Open Cluster Management, or OCM, integration). +- **Import & lifecycle** — check/validate/import clusters, connect or re-connect to an + already-imported cluster, reconcile Helm releases, reconfigure components, and remove + a cluster. +- **Kubernetes version upgrades** — inspect upgradeable versions and trigger CAPI + cluster upgrades. +- **Gateway configurations** — list gateway configs and update them to the current KubeDB Platform + chart version. +- **vcluster support** — create or import virtual clusters on a host cluster. +- **Inbox subscriptions** — subscribe the current user to cluster-, namespace-, or + resource-level inbox notifications, plus obtain an inbox agent token for a cluster. + +All routes require a personal access token (`Authorization: token `). Most routes are +scoped to an `owner` (organization slug or username) and, for cluster-scoped routes, a +`cluster` name; a few (skip-credentials, all-hubs, identity, all-clusters) require +site-admin privileges. `/api/v1/clustersv2` @@ -44,7 +69,10 @@ vcluster support. All routes require Token. Related: `GET /api/v1/agent/:clusterName/:clusterID/token` (Token) — inbox agent token for a cluster. -## Reference pages +## Pages -- [Clusters](../clusters.md) -- [Subscriptions & Inbox](../subscriptions.md) +- [Clusters](../clusters.md) — providers, hubs, cluster identity, + listing, status, import/connect/remove, reconcile, reconfigure, Kubernetes version + upgrades, gateway configs, feature conversion, and vclusters. +- [Subscriptions & Inbox](../subscriptions.md) — cluster, + namespace, and resource notification subscriptions, plus the inbox agent token. diff --git a/docs/platform/api/cluster-management-v2/_index.md b/docs/platform/api/cluster-management-v2/_index.md index 680c536..2e37f5d 100644 --- a/docs/platform/api/cluster-management-v2/_index.md +++ b/docs/platform/api/cluster-management-v2/_index.md @@ -9,35 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Cluster Management v2 - -The Cluster Management v2 API is the newer, hub-aware cluster surface served under -`/api/v1/clustersv2`. It builds on [Cluster Management v1](../../cluster-management-v1/) -and adds: - -- **Hub awareness** — list hub clusters, resolve hub connection info, and check hub - presence for an owner (Open Cluster Management, or OCM, integration). -- **Import & lifecycle** — check/validate/import clusters, connect or re-connect to an - already-imported cluster, reconcile Helm releases, reconfigure components, and remove - a cluster. -- **Kubernetes version upgrades** — inspect upgradeable versions and trigger CAPI - cluster upgrades. -- **Gateway configurations** — list gateway configs and update them to the current KubeDB Platform - chart version. -- **vcluster support** — create or import virtual clusters on a host cluster. -- **Inbox subscriptions** — subscribe the current user to cluster-, namespace-, or - resource-level inbox notifications, plus obtain an inbox agent token for a cluster. - -All routes require a personal access token (`Authorization: token `). Most routes are -scoped to an `owner` (organization slug or username) and, for cluster-scoped routes, a -`cluster` name; a few (skip-credentials, all-hubs, identity, all-clusters) require -site-admin privileges. - -## Pages - -- [Clusters](../clusters.md) — providers, hubs, cluster identity, - listing, status, import/connect/remove, reconcile, reconfigure, Kubernetes version - upgrades, gateway configs, feature conversion, and vclusters. -- [Subscriptions & Inbox](../subscriptions.md) — cluster, - namespace, and resource notification subscriptions, plus the inbox agent token. diff --git a/docs/platform/api/licensing-contracts/overview.md b/docs/platform/api/licensing-contracts/README.md similarity index 57% rename from docs/platform/api/licensing-contracts/overview.md rename to docs/platform/api/licensing-contracts/README.md index 4544b3a..292c631 100644 --- a/docs/platform/api/licensing-contracts/overview.md +++ b/docs/platform/api/licensing-contracts/README.md @@ -2,15 +2,36 @@ layout: docs menu: docsplatform_{{.version}}: - identifier: api-licensing-contracts-overview + identifier: api-licensing-contracts-readme name: Overview parent: api-licensing-contracts - weight: 5 + weight: -1 menu_name: docsplatform_{{.version}} section_menu_id: api +url: /docs/platform/{{.version}}/api/licensing-contracts/ +aliases: +- /docs/platform/{{.version}}/api/licensing-contracts/overview/ --- -# Licensing & Contracts — Overview +# Licensing & Contracts + +Contracts bind an organization (or user) to products, clusters, and usage quotas; +licenses are issued per contract-cluster. This group covers three related concerns: + +- **License registration** — the always-available endpoints that member clusters + (via `license-proxyserver`) use to validate a license and obtain a fresh one. +- **Contracts (admin)** — the AppsCode-hosted, site-admin console for managing every + contract across accounts. +- **Contracts (user)** — the AppsCode-hosted, token-scoped API an organization uses to + manage its own contracts, bind clusters, and issue offline licenses. + +All routes are served under the `/api/v1` prefix. + +> **Deployment note.** The `/contracts/*` and `/user/contracts/*` families — plus +> `POST /user/license-proxy` — are **AppsCode-hosted-only**. On a self-hosted platform +> these routes are not registered and return `404 Not Found`. They are documented here +> for completeness; the verification notes below record the observed behavior on the +> self-hosted test platform. Contracts bind an organization to products, clusters, and quotas; licenses are issued per contract-cluster. The license flow is what member clusters (via `license-proxyserver`) use. @@ -56,8 +77,21 @@ contract-cluster. The license flow is what member clusters (via `license-proxyse Related: `POST /api/v1/user/license-proxy` — generate the `license-proxyserver` installer for a cluster. -## Reference pages +## Pages + +- [License Registration](../registration.md) — `POST /register`, + `POST /license/issue`, `POST /user/license-proxy`. +- [Contracts — Admin](../contracts-admin.md) — `/contracts/*` + (AppsCode-hosted, site-admin). +- [Contracts — User](../contracts-user.md) — `/user/contracts/*` + (AppsCode-hosted, token). + +## Common concepts -- [License registration](../registration.md) -- [Contracts — admin](../contracts-admin.md) -- [Contracts — user](../contracts-user.md) +- **Owner scope.** Contract endpoints accept an owner (organization) context via the + optional `?org=` query parameter. When omitted, the caller's own account is used. +- **Contract IDs** (`id`) are numeric (`int64`). A **contract-cluster ID** (`ccID`) is + the numeric ID of a cluster's binding within a specific contract — distinct from the + cluster UUID. +- **Cluster UUID** (`clusterID` / `cluster`) is the cluster's UUID string. +- Timestamps on the `Contract` object (`start`, `end`) are Unix seconds. diff --git a/docs/platform/api/licensing-contracts/_index.md b/docs/platform/api/licensing-contracts/_index.md index 13a3612..a5b829d 100644 --- a/docs/platform/api/licensing-contracts/_index.md +++ b/docs/platform/api/licensing-contracts/_index.md @@ -9,42 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Licensing & Contracts - -Contracts bind an organization (or user) to products, clusters, and usage quotas; -licenses are issued per contract-cluster. This group covers three related concerns: - -- **License registration** — the always-available endpoints that member clusters - (via `license-proxyserver`) use to validate a license and obtain a fresh one. -- **Contracts (admin)** — the AppsCode-hosted, site-admin console for managing every - contract across accounts. -- **Contracts (user)** — the AppsCode-hosted, token-scoped API an organization uses to - manage its own contracts, bind clusters, and issue offline licenses. - -All routes are served under the `/api/v1` prefix. - -> **Deployment note.** The `/contracts/*` and `/user/contracts/*` families — plus -> `POST /user/license-proxy` — are **AppsCode-hosted-only**. On a self-hosted platform -> these routes are not registered and return `404 Not Found`. They are documented here -> for completeness; the verification notes below record the observed behavior on the -> self-hosted test platform. - -## Pages - -- [License Registration](../registration.md) — `POST /register`, - `POST /license/issue`, `POST /user/license-proxy`. -- [Contracts — Admin](../contracts-admin.md) — `/contracts/*` - (AppsCode-hosted, site-admin). -- [Contracts — User](../contracts-user.md) — `/user/contracts/*` - (AppsCode-hosted, token). - -## Common concepts - -- **Owner scope.** Contract endpoints accept an owner (organization) context via the - optional `?org=` query parameter. When omitted, the caller's own account is used. -- **Contract IDs** (`id`) are numeric (`int64`). A **contract-cluster ID** (`ccID`) is - the numeric ID of a cluster's binding within a specific contract — distinct from the - cluster UUID. -- **Cluster UUID** (`clusterID` / `cluster`) is the cluster's UUID string. -- Timestamps on the `Contract` object (`start`, `end`) are Unix seconds. diff --git a/docs/platform/api/marketplace/README.md b/docs/platform/api/marketplace/README.md new file mode 100644 index 0000000..5d64c14 --- /dev/null +++ b/docs/platform/api/marketplace/README.md @@ -0,0 +1,60 @@ +--- +layout: docs +menu: + docsplatform_{{.version}}: + identifier: api-marketplace-readme + name: Overview + parent: api-marketplace + weight: -1 +menu_name: docsplatform_{{.version}} +section_menu_id: api +url: /docs/platform/{{.version}}/api/marketplace/ +aliases: +- /docs/platform/{{.version}}/api/marketplace/overview/ +--- + +# Marketplace + +The Marketplace APIs integrate the KubeDB Platform with the public cloud marketplaces (AWS, Azure, +GCP). They cover two distinct surfaces served by two different processes: + +- **Marketplace webhook service** — a **separate listener** rooted at + `/marketplace/api/v1` (not `/api/v1`). It receives subscription lifecycle + notifications from the cloud marketplaces, answers the standalone-organization + claimable check, and serves a version endpoint. These routes only exist when the + API Server binary runs its `marketplace` subcommand as part of a marketplace deployment. +- **Metered-billing proxy** (`/api/v1/proxy/metered-billing/marketplaces/*`) — a + site-admin proxy on the **main** API server that forwards metered-usage reports + and readiness probes to the AWS Marketplace Metering / GCP Service Control APIs. + Each provider's routes are registered **only** for the matching deployment type + (`AWSMarketplaceDeployment` / `GCPMarketplaceDeployment`); on any other deployment + they do not exist and return `404`. + +Because these endpoints are gated by marketplace deployment types, most of them are +**unavailable on a standard KubeDB Platform installation**. Each page notes the gating and, for +GET endpoints, the observed behaviour on a non-marketplace deployment. + +> **Note on the two listeners:** the webhook service listens on its own root +> `/marketplace/api/v1`, which is **different** from the main server's `/api/v1` +> prefix used everywhere else in this reference. It shares the `GET /version` +> response shape with the main server but runs as a separate process. + +## Webhook service (separate listener rooted at `/marketplace/api`, marketplace deployments) + +| Method | Path | Auth | Description | +|--------|------|------|-------------| +| GET | `/marketplace/api/v1/marketplaces/standalone-organizations/:claimID/claimable` | Public | Check claim rules of a standalone org | +| POST | `/marketplace/api/v1/marketplaces/{aws,azure,gcp}/notification/resource` | Webhook | Cloud-marketplace subscription notifications | +| GET | `/marketplace/api/v1/version` | Public | Service version | + +## Metered-billing proxy (`/api/v1/proxy/metered-billing/marketplaces`, site admin) + +| Method | Path | Gated by | Description | +|--------|------|----------|-------------| +| POST | `/aws/report-usage`, GET `/aws/check/readiness` | AWS marketplace deployment | Report metered usage / readiness | +| POST | `/gcp/report-usage`, GET `/gcp/check/readiness` | GCP marketplace deployment | Report metered usage / readiness | + +## Pages + +- [Webhook Service](../webhook-service.md) — `/marketplace/api/v1/*`: claimable check, AWS/Azure/GCP subscription notifications, and version (separate listener). +- [Metered Billing](../metered-billing.md) — `/api/v1/proxy/metered-billing/marketplaces/*`: AWS/GCP usage reporting and readiness probes (site-admin, deployment-gated). diff --git a/docs/platform/api/marketplace/_index.md b/docs/platform/api/marketplace/_index.md index f7306f9..61a86cb 100644 --- a/docs/platform/api/marketplace/_index.md +++ b/docs/platform/api/marketplace/_index.md @@ -9,34 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Marketplace - -The Marketplace APIs integrate the KubeDB Platform with the public cloud marketplaces (AWS, Azure, -GCP). They cover two distinct surfaces served by two different processes: - -- **Marketplace webhook service** — a **separate listener** rooted at - `/marketplace/api/v1` (not `/api/v1`). It receives subscription lifecycle - notifications from the cloud marketplaces, answers the standalone-organization - claimable check, and serves a version endpoint. These routes only exist when the - API Server binary runs its `marketplace` subcommand as part of a marketplace deployment. -- **Metered-billing proxy** (`/api/v1/proxy/metered-billing/marketplaces/*`) — a - site-admin proxy on the **main** API server that forwards metered-usage reports - and readiness probes to the AWS Marketplace Metering / GCP Service Control APIs. - Each provider's routes are registered **only** for the matching deployment type - (`AWSMarketplaceDeployment` / `GCPMarketplaceDeployment`); on any other deployment - they do not exist and return `404`. - -Because these endpoints are gated by marketplace deployment types, most of them are -**unavailable on a standard KubeDB Platform installation**. Each page notes the gating and, for -GET endpoints, the observed behaviour on a non-marketplace deployment. - -> **Note on the two listeners:** the webhook service listens on its own root -> `/marketplace/api/v1`, which is **different** from the main server's `/api/v1` -> prefix used everywhere else in this reference. It shares the `GET /version` -> response shape with the main server but runs as a separate process. - -## Pages - -- [Webhook Service](../webhook-service.md) — `/marketplace/api/v1/*`: claimable check, AWS/Azure/GCP subscription notifications, and version (separate listener). -- [Metered Billing](../metered-billing.md) — `/api/v1/proxy/metered-billing/marketplaces/*`: AWS/GCP usage reporting and readiness probes (site-admin, deployment-gated). diff --git a/docs/platform/api/marketplace/overview.md b/docs/platform/api/marketplace/overview.md deleted file mode 100644 index b673d1b..0000000 --- a/docs/platform/api/marketplace/overview.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -layout: docs -menu: - docsplatform_{{.version}}: - identifier: api-marketplace-overview - name: Overview - parent: api-marketplace - weight: 5 -menu_name: docsplatform_{{.version}} -section_menu_id: api ---- - -# Marketplace — Overview - -## Webhook service (separate listener rooted at `/marketplace/api`, marketplace deployments) - -| Method | Path | Auth | Description | -|--------|------|------|-------------| -| GET | `/marketplace/api/v1/marketplaces/standalone-organizations/:claimID/claimable` | Public | Check claim rules of a standalone org | -| POST | `/marketplace/api/v1/marketplaces/{aws,azure,gcp}/notification/resource` | Webhook | Cloud-marketplace subscription notifications | -| GET | `/marketplace/api/v1/version` | Public | Service version | - -## Metered-billing proxy (`/api/v1/proxy/metered-billing/marketplaces`, site admin) - -| Method | Path | Gated by | Description | -|--------|------|----------|-------------| -| POST | `/aws/report-usage`, GET `/aws/check/readiness` | AWS marketplace deployment | Report metered usage / readiness | -| POST | `/gcp/report-usage`, GET `/gcp/check/readiness` | GCP marketplace deployment | Report metered usage / readiness | - -## Reference pages - -- [Webhook service](../webhook-service.md) -- [Metered billing](../metered-billing.md) diff --git a/docs/platform/api/miscellaneous/README.md b/docs/platform/api/miscellaneous/README.md new file mode 100644 index 0000000..04c55ef --- /dev/null +++ b/docs/platform/api/miscellaneous/README.md @@ -0,0 +1,43 @@ +--- +layout: docs +menu: + docsplatform_{{.version}}: + identifier: api-miscellaneous-readme + name: Overview + parent: api-miscellaneous + weight: -1 +menu_name: docsplatform_{{.version}} +section_menu_id: api +url: /docs/platform/{{.version}}/api/miscellaneous/ +aliases: +- /docs/platform/{{.version}}/api/miscellaneous/overview/ +--- + +# Miscellaneous + +Small utility and infrastructure endpoints exposed by the KubeDB Platform API Server: the server +version, a markdown-to-HTML renderer, the Swagger UI page, a health check, and the +OpenID Connect discovery document. These are all public (no authentication) and back +various parts of the KubeDB Platform web console and its OIDC provider. + +Most of these routes live under the `/api/v1` prefix like the rest of the API. Two of +them — the health check and the OIDC discovery document — are served at the **host +root**, not under `/api/v1`; their full paths are documented as-is. + +| Method | Path | Auth | Description | +|--------|------|------|-------------| +| GET | `/api/v1/version` | Public | Server version | +| GET | `/api/v1/swagger` | Public (if enabled) | Swagger UI | +| POST | `/api/v1/markdown`, `/api/v1/markdown/raw` | Public | Render markdown to HTML | +| GET | `/healthz` | Public | Health check (non-API root) | +| GET | `/.well-known/openid-configuration` | Public | OIDC discovery (non-API root) | + +Web (non-API) routes also exist for the sign-in/sign-up UI, OAuth2 authorize/token/userinfo endpoints, +account activation & recovery, 2FA/WebAuthn login, and static assets. + +## Pages + +- [Miscellaneous Endpoints](../miscellaneous.md) — server version + (`/api/v1/version`), markdown rendering (`/api/v1/markdown`, `/api/v1/markdown/raw`), + the Swagger UI (`/api/v1/swagger`), the health check (`/healthz`), and OIDC discovery + (`/.well-known/openid-configuration`). diff --git a/docs/platform/api/miscellaneous/_index.md b/docs/platform/api/miscellaneous/_index.md index 410da06..d83e51a 100644 --- a/docs/platform/api/miscellaneous/_index.md +++ b/docs/platform/api/miscellaneous/_index.md @@ -9,21 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Miscellaneous - -Small utility and infrastructure endpoints exposed by the KubeDB Platform API Server: the server -version, a markdown-to-HTML renderer, the Swagger UI page, a health check, and the -OpenID Connect discovery document. These are all public (no authentication) and back -various parts of the KubeDB Platform web console and its OIDC provider. - -Most of these routes live under the `/api/v1` prefix like the rest of the API. Two of -them — the health check and the OIDC discovery document — are served at the **host -root**, not under `/api/v1`; their full paths are documented as-is. - -## Pages - -- [Miscellaneous Endpoints](../miscellaneous.md) — server version - (`/api/v1/version`), markdown rendering (`/api/v1/markdown`, `/api/v1/markdown/raw`), - the Swagger UI (`/api/v1/swagger`), the health check (`/healthz`), and OIDC discovery - (`/.well-known/openid-configuration`). diff --git a/docs/platform/api/miscellaneous/overview.md b/docs/platform/api/miscellaneous/overview.md deleted file mode 100644 index 2ecf3e5..0000000 --- a/docs/platform/api/miscellaneous/overview.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -layout: docs -menu: - docsplatform_{{.version}}: - identifier: api-miscellaneous-overview - name: Overview - parent: api-miscellaneous - weight: 5 -menu_name: docsplatform_{{.version}} -section_menu_id: api ---- - -# Miscellaneous — Overview - -| Method | Path | Auth | Description | -|--------|------|------|-------------| -| GET | `/api/v1/version` | Public | Server version | -| GET | `/api/v1/swagger` | Public (if enabled) | Swagger UI | -| POST | `/api/v1/markdown`, `/api/v1/markdown/raw` | Public | Render markdown to HTML | -| GET | `/healthz` | Public | Health check (non-API root) | -| GET | `/.well-known/openid-configuration` | Public | OIDC discovery (non-API root) | - -Web (non-API) routes also exist for the sign-in/sign-up UI, OAuth2 authorize/token/userinfo endpoints, -account activation & recovery, 2FA/WebAuthn login, and static assets. - -## Reference pages - -- [Miscellaneous](../miscellaneous.md) diff --git a/docs/platform/api/monitoring-telemetry/README.md b/docs/platform/api/monitoring-telemetry/README.md new file mode 100644 index 0000000..1d93e29 --- /dev/null +++ b/docs/platform/api/monitoring-telemetry/README.md @@ -0,0 +1,62 @@ +--- +layout: docs +menu: + docsplatform_{{.version}}: + identifier: api-monitoring-telemetry-readme + name: Overview + parent: api-monitoring-telemetry + weight: -1 +menu_name: docsplatform_{{.version}} +section_menu_id: api +url: /docs/platform/{{.version}}/api/monitoring-telemetry/ +aliases: +- /docs/platform/{{.version}}/api/monitoring-telemetry/overview/ +--- + +# Monitoring & Telemetry API + +The Monitoring & Telemetry API provisions and wires up the observability plane of the +KubeDB Platform. It has two surfaces: + +- **Telemetry stack** (`/api/v1/telemetry/...`) — designates one of an owner's imported + clusters as a *monitoring cluster*, installs the OpenTelemetry-based telemetry stack + (`appscode-otel-stack` / `opentelemetry-kube-stack`) on it, and generates the Helm + values that target clusters use to ship metrics, logs, and traces to that monitoring + cluster. It also exposes the stack's ingress host and lists the tenants served. +- **Trickster / Prometheus auth proxy** (`/api/v1/trickster/...`) — registers and + unregisters per-cluster Prometheus backends behind the Trickster proxy (for Grafana or + Perses datasources) and provides the ownership/auth hook that `prom-authproxy` calls to + enforce per-tenant access to Prometheus data. + +> **Auth.** Every route in this group requires a valid bearer token +> (`Authorization: token `, or the `?token=` / `?access_token=` query forms) and +> org-admin context: the caller must be an **admin of the `{owner}` organization** (or, +> for the Trickster routes, a member/owner of the org that owns the referenced cluster). +> These routes are registered in all deployment modes. + +## Telemetry stack (`/api/v1/telemetry/:owner`, Token + org admin) + +| Method | Path | Description | +|--------|------|-------------| +| GET | `/monitoring-clusters` | List clusters serving as monitoring clusters | +| POST | `/:cluster/stack` | Install the telemetry (OTel) stack on a cluster | +| GET | `/:cluster/values/appscode-otel-stack` | Helm values of the OTel stack | +| GET | `/:cluster/stack/host` | Telemetry stack endpoint | +| GET | `/:cluster/tenants/ownerlist` | Tenant owners served by this monitoring cluster | + +## Trickster / Prometheus auth proxy (`/api/v1/trickster`, Token + org admin) + +| Method | Path | Description | +|--------|------|-------------| +| POST | `/register`, `/unregister` | Register / unregister a Prometheus backend | +| POST | `/perses/register`, `/perses/unregister` | Same, for Perses dashboards | +| GET | `/auth/:uidcid/*` | Ownership/auth check for a `uid.clusterid` identity | + +## Pages + +- [Telemetry Stack](../telemetry-stack.md) — list monitoring + clusters, install the telemetry stack, fetch `appscode-otel-stack` Helm values, get the + stack host, and list tenant owners. +- [Trickster Auth Proxy](../trickster.md) — register/unregister + Prometheus backends for Grafana and Perses datasources, and the `prom-authproxy` + ownership check. diff --git a/docs/platform/api/monitoring-telemetry/_index.md b/docs/platform/api/monitoring-telemetry/_index.md index 6866c38..f6ef358 100644 --- a/docs/platform/api/monitoring-telemetry/_index.md +++ b/docs/platform/api/monitoring-telemetry/_index.md @@ -9,33 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Monitoring & Telemetry API - -The Monitoring & Telemetry API provisions and wires up the observability plane of the -KubeDB Platform. It has two surfaces: - -- **Telemetry stack** (`/api/v1/telemetry/...`) — designates one of an owner's imported - clusters as a *monitoring cluster*, installs the OpenTelemetry-based telemetry stack - (`appscode-otel-stack` / `opentelemetry-kube-stack`) on it, and generates the Helm - values that target clusters use to ship metrics, logs, and traces to that monitoring - cluster. It also exposes the stack's ingress host and lists the tenants served. -- **Trickster / Prometheus auth proxy** (`/api/v1/trickster/...`) — registers and - unregisters per-cluster Prometheus backends behind the Trickster proxy (for Grafana or - Perses datasources) and provides the ownership/auth hook that `prom-authproxy` calls to - enforce per-tenant access to Prometheus data. - -> **Auth.** Every route in this group requires a valid bearer token -> (`Authorization: token `, or the `?token=` / `?access_token=` query forms) and -> org-admin context: the caller must be an **admin of the `{owner}` organization** (or, -> for the Trickster routes, a member/owner of the org that owns the referenced cluster). -> These routes are registered in all deployment modes. - -## Pages - -- [Telemetry Stack](../telemetry-stack.md) — list monitoring - clusters, install the telemetry stack, fetch `appscode-otel-stack` Helm values, get the - stack host, and list tenant owners. -- [Trickster Auth Proxy](../trickster.md) — register/unregister - Prometheus backends for Grafana and Perses datasources, and the `prom-authproxy` - ownership check. diff --git a/docs/platform/api/monitoring-telemetry/overview.md b/docs/platform/api/monitoring-telemetry/overview.md deleted file mode 100644 index c06a975..0000000 --- a/docs/platform/api/monitoring-telemetry/overview.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -layout: docs -menu: - docsplatform_{{.version}}: - identifier: api-monitoring-telemetry-overview - name: Overview - parent: api-monitoring-telemetry - weight: 5 -menu_name: docsplatform_{{.version}} -section_menu_id: api ---- - -# Monitoring & Telemetry — Overview - -## Telemetry stack (`/api/v1/telemetry/:owner`, Token + org admin) - -| Method | Path | Description | -|--------|------|-------------| -| GET | `/monitoring-clusters` | List clusters serving as monitoring clusters | -| POST | `/:cluster/stack` | Install the telemetry (OTel) stack on a cluster | -| GET | `/:cluster/values/appscode-otel-stack` | Helm values of the OTel stack | -| GET | `/:cluster/stack/host` | Telemetry stack endpoint | -| GET | `/:cluster/tenants/ownerlist` | Tenant owners served by this monitoring cluster | - -## Trickster / Prometheus auth proxy (`/api/v1/trickster`, Token + org admin) - -| Method | Path | Description | -|--------|------|-------------| -| POST | `/register`, `/unregister` | Register / unregister a Prometheus backend | -| POST | `/perses/register`, `/perses/unregister` | Same, for Perses dashboards | -| GET | `/auth/:uidcid/*` | Ownership/auth check for a `uid.clusterid` identity | - -## Reference pages - -- [Telemetry stack](../telemetry-stack.md) -- [Trickster](../trickster.md) diff --git a/docs/platform/api/multicluster-ocm/overview.md b/docs/platform/api/multicluster-ocm/README.md similarity index 53% rename from docs/platform/api/multicluster-ocm/overview.md rename to docs/platform/api/multicluster-ocm/README.md index b84761e..ae8ec9e 100644 --- a/docs/platform/api/multicluster-ocm/overview.md +++ b/docs/platform/api/multicluster-ocm/README.md @@ -2,15 +2,35 @@ layout: docs menu: docsplatform_{{.version}}: - identifier: api-multicluster-ocm-overview + identifier: api-multicluster-ocm-readme name: Overview parent: api-multicluster-ocm - weight: 5 + weight: -1 menu_name: docsplatform_{{.version}} section_menu_id: api +url: /docs/platform/{{.version}}/api/multicluster-ocm/ +aliases: +- /docs/platform/{{.version}}/api/multicluster-ocm/overview/ --- -# Multi-cluster: OCM Hub & Spoke — Overview +# Multi-cluster (OCM) + +APIs for Open Cluster Management (OCM) on the KubeDB Platform: hub clusters, spoke +(managed) clusters, cluster sets, feature sets, namespace bindings, and OCM users. +A *hub* cluster runs the OCM control plane; *spoke* clusters register with it and +are then grouped into *cluster sets* on which feature sets can be installed and kept +in sync. These endpoints back the multi-cluster / hub screens of the KubeDB Platform web console +and let you script the same operations against the KubeDB Platform API Server. + +All routes are served under the `/api/v1` prefix and are scoped to an owner and a hub +cluster: `/api/v1/clusters/{owner}/...` (owner-only, e.g. `/hubs`) or +`/api/v1/clusters/{owner}/{cluster}/...` where `{cluster}` is the hub cluster. The +`owner` is an organization or user slug; `{cluster}` is the hub cluster name. Every +endpoint authenticates with a personal access token sent as +`Authorization: token ` (it may also be supplied as a `token` or +`access_token` query parameter). All routes additionally resolve the owner +organization/user and map the cluster before running; failures surface as `401` +(unauthenticated) or `403` (not authorized for the owner/cluster). `/api/v1/clusters/:owner/...` @@ -42,8 +62,15 @@ All require Token + org/user resolution + cluster mapping. | GET | `/:owner/:cluster/user/:id` (+`/access`, `/:spokeName/kubeconfig`) | OCM user info / access / kubeconfig | | POST | `/:owner/:cluster/user/:id/{remove,update}`, DELETE `/user/:id/delete` | Manage OCM user permissions | -## Reference pages +## Pages -- [Hubs & spokes](../hubs-spokes.md) -- [Cluster sets](../cluster-sets.md) -- [OCM users](../ocm-users.md) +- [Hubs & Spokes](../hubs-spokes.md) — list hub clusters, inspect + spoke inventories (managed / accepted / not-accepted / available), accept spoke + join requests, generate the spoke install command, import or convert a cluster to + a spoke, remove a managed cluster, validate profiles, and sync account objects. +- [Cluster Sets & Feature Sets](../cluster-sets.md) — create, + delete, and populate cluster sets; install/disable/update feature sets; check + feature sync status and auto-update; and bind namespaces to cluster sets. +- [OCM Users](../ocm-users.md) — list, create, inspect, update, and + delete OCM users and their per-cluster / per-cluster-set permissions, and fetch a + user's kubeconfig for a spoke cluster. diff --git a/docs/platform/api/multicluster-ocm/_index.md b/docs/platform/api/multicluster-ocm/_index.md index 6daa698..426b7e5 100644 --- a/docs/platform/api/multicluster-ocm/_index.md +++ b/docs/platform/api/multicluster-ocm/_index.md @@ -9,35 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Multi-cluster (OCM) - -APIs for Open Cluster Management (OCM) on the KubeDB Platform: hub clusters, spoke -(managed) clusters, cluster sets, feature sets, namespace bindings, and OCM users. -A *hub* cluster runs the OCM control plane; *spoke* clusters register with it and -are then grouped into *cluster sets* on which feature sets can be installed and kept -in sync. These endpoints back the multi-cluster / hub screens of the KubeDB Platform web console -and let you script the same operations against the KubeDB Platform API Server. - -All routes are served under the `/api/v1` prefix and are scoped to an owner and a hub -cluster: `/api/v1/clusters/{owner}/...` (owner-only, e.g. `/hubs`) or -`/api/v1/clusters/{owner}/{cluster}/...` where `{cluster}` is the hub cluster. The -`owner` is an organization or user slug; `{cluster}` is the hub cluster name. Every -endpoint authenticates with a personal access token sent as -`Authorization: token ` (it may also be supplied as a `token` or -`access_token` query parameter). All routes additionally resolve the owner -organization/user and map the cluster before running; failures surface as `401` -(unauthenticated) or `403` (not authorized for the owner/cluster). - -## Pages - -- [Hubs & Spokes](../hubs-spokes.md) — list hub clusters, inspect - spoke inventories (managed / accepted / not-accepted / available), accept spoke - join requests, generate the spoke install command, import or convert a cluster to - a spoke, remove a managed cluster, validate profiles, and sync account objects. -- [Cluster Sets & Feature Sets](../cluster-sets.md) — create, - delete, and populate cluster sets; install/disable/update feature sets; check - feature sync status and auto-update; and bind namespaces to cluster sets. -- [OCM Users](../ocm-users.md) — list, create, inspect, update, and - delete OCM users and their per-cluster / per-cluster-set permissions, and fetch a - user's kubeconfig for a spoke cluster. diff --git a/docs/platform/api/organizations-teams/overview.md b/docs/platform/api/organizations-teams/README.md similarity index 69% rename from docs/platform/api/organizations-teams/overview.md rename to docs/platform/api/organizations-teams/README.md index 5d57d70..7203a9e 100644 --- a/docs/platform/api/organizations-teams/overview.md +++ b/docs/platform/api/organizations-teams/README.md @@ -2,15 +2,29 @@ layout: docs menu: docsplatform_{{.version}}: - identifier: api-organizations-teams-overview + identifier: api-organizations-teams-readme name: Overview parent: api-organizations-teams - weight: 5 + weight: -1 menu_name: docsplatform_{{.version}} section_menu_id: api +url: /docs/platform/{{.version}}/api/organizations-teams/ +aliases: +- /docs/platform/{{.version}}/api/organizations-teams/overview/ --- -# Identity: Organizations & Teams — Overview +# Identity: Organizations & Teams + +APIs for organizations and the teams inside them. Organizations own clusters, +contracts, and billing scope; teams provide per-org grouping with role-based +permissions. All authorization checks are OpenFGA-backed (relationship-based), so +access to each endpoint depends on the caller's role in the organization or team. + +All routes are served under the `/api/v1` prefix. Most endpoints authenticate with a +personal access token sent as `Authorization: token ` (it may also be +supplied as a `token` or `access_token` query parameter). A few read endpoints are +public (no auth) and return only what an anonymous caller may see — this is called +out per endpoint. Organizations own clusters, contracts, and billing scope. Teams provide per-org grouping with role-based permissions (all checks are OpenFGA-backed). @@ -44,7 +58,12 @@ role-based permissions (all checks are OpenFGA-backed). | GET | `/api/v1/teams/:teamid/members`, `/:username` | authzCheck(view) | List / get team members | | PUT/DELETE | `/api/v1/teams/:teamid/members/:username` | authzCheck(add/remove:team-member) | Add / remove team member | -## Reference pages +## Pages -- [Organizations](../organizations.md) -- [Teams](../teams.md) +- [Organizations](../organizations.md) — the `/api/v1/orgs/*` + endpoints: create/claim organizations, get/edit/delete an org, ownership and + membership checks, member management, avatars, Rancher sync/user tokens, and org + access/NATS tokens. +- [Teams](../teams.md) — the `/api/v1/orgs/{orgname}/teams` and + `/api/v1/teams/{teamid}/*` endpoints: list/create teams, team actions, and team + member management. diff --git a/docs/platform/api/organizations-teams/_index.md b/docs/platform/api/organizations-teams/_index.md index 025bacb..eabc669 100644 --- a/docs/platform/api/organizations-teams/_index.md +++ b/docs/platform/api/organizations-teams/_index.md @@ -9,26 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Identity: Organizations & Teams - -APIs for organizations and the teams inside them. Organizations own clusters, -contracts, and billing scope; teams provide per-org grouping with role-based -permissions. All authorization checks are OpenFGA-backed (relationship-based), so -access to each endpoint depends on the caller's role in the organization or team. - -All routes are served under the `/api/v1` prefix. Most endpoints authenticate with a -personal access token sent as `Authorization: token ` (it may also be -supplied as a `token` or `access_token` query parameter). A few read endpoints are -public (no auth) and return only what an anonymous caller may see — this is called -out per endpoint. - -## Pages - -- [Organizations](../organizations.md) — the `/api/v1/orgs/*` - endpoints: create/claim organizations, get/edit/delete an org, ownership and - membership checks, member management, avatars, Rancher sync/user tokens, and org - access/NATS tokens. -- [Teams](../teams.md) — the `/api/v1/orgs/{orgname}/teams` and - `/api/v1/teams/{teamid}/*` endpoints: list/create teams, team actions, and team - member management. diff --git a/docs/platform/api/overview.md b/docs/platform/api/overview.md deleted file mode 100644 index 13a58fe..0000000 --- a/docs/platform/api/overview.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -layout: docs -menu: - docsplatform_{{.version}}: - identifier: api-overview - name: Overview - parent: api - weight: 5 -menu_name: docsplatform_{{.version}} -section_menu_id: api ---- - -# KubeDB Platform API Server — High-Level Design - -High-level design of the KubeDB Platform API Server. -This page gives you the whole-system picture — what the KubeDB Platform API Server does, how it is put -together, how requests are authenticated and authorized, and how the pieces fit -into typical flows. For the endpoint-by-endpoint reference, use the per-group -pages linked from the [API Reference index](../_index.md); each group also has -its own **Overview** page describing that group's role in the platform. - -## 1. Overview - -The KubeDB Platform API Server is the backend server of the **KubeDB Platform**. It combines an identity -foundation (users, organizations, teams, authentication) with a multi-cluster Kubernetes -management platform providing: - -- **Identity & access management** — users, organizations, teams, fine-grained authorization. -- **Cluster management** — import, provision, and operate Kubernetes clusters (hub/spoke via Open Cluster Management, Rancher, cloud providers). -- **A full Kubernetes API proxy** — the KubeDB Platform UI talks to member clusters through the KubeDB Platform API Server. -- **Licensing & contracts** — issuing and enforcing product licenses (KubeDB, KubeStash, KubeVault, Voyager, ...). -- **Billing & usage reporting** — usage aggregation, invoices, cloud-marketplace metering (AWS/Azure/GCP). -- **Monitoring & telemetry** — telemetry stack provisioning, Prometheus/Trickster auth proxying. - -All REST APIs are served under the `/api/v1` prefix. - -## 2. System Architecture - -![KubeDB Platform system architecture](../images/architecture.svg) - -Key runtime facts: - -- One binary, multiple subcommands. The default command is the API server; `marketplace`, `monitor`, - `aggregator`, and `summary` run as separate processes for async/billing workloads. -- **NATS/JetStream** is the event backbone: member clusters push resource/usage events; `monitor` and - `aggregator` consume them; the API server also uses NATS for its task manager and per-user credentials. -- **FluxCD (HelmRelease)** and **OCM (ManagedCluster)** are used to deploy KubeDB Platform features onto clusters and - to manage hub→spoke relationships. -- Deployment modes are switched by `DEPLOYMENT_TYPE`: AppsCode-hosted, self-hosted (incl. offline - installer), or AWS/GCP marketplace deployments. Some API groups only exist in specific modes (noted below). - -## 3. Authentication & Authorization - -| Mechanism | Used by | Notes | -|---|---|---| -| Session cookie | Web console | Cookie-based sign-in; CSRF-protected | -| Personal access token / Bearer token | API clients, CLI | `Authorization: token `, `?token=`, `?access_token=` | -| Basic auth | Token management endpoints | With optional OTP (2FA) | -| OAuth2 / OIDC | SSO; the KubeDB Platform API Server is both provider and consumer | `/login/oauth/*`, `/.well-known/openid-configuration` | -| LDAP / PAM | Enterprise sign-in sources | Configured by site admins | -| 2FA / WebAuthn | User accounts | TOTP, scratch tokens, security keys | -| License-based auth | Member clusters | Clusters authenticate with issued licenses / cluster tokens | -| Sudo | Site admins | Impersonate a user via `sudo` param/header | - -Authorization is relationship-based (OpenFGA-style checks, shown as `authzCheck()` in the -reference tables). Common middleware referenced in the API tables: - -- **Token** — authenticated request required (`reqToken`). -- **Site admin** — platform administrator only. -- **Org context** — org resolved from path or `?org=` query; membership/ownership verified. -- **Cluster assignment** — resolves owner+cluster, loads cluster credentials, builds a Kubernetes client. -- **Public** — no authentication beyond baseline middleware. - -Baseline middleware on every `/api/v1` route: optional-sign-in, NATS connection cleanup, -security headers (`nosniff`), API context, sudo support. - -## 4. API Groups - -The v1 API surface is organized into the following logical groups: - -| # | Group | Base path(s) | Availability | -|---|-------|--------------|--------------| -| 1 | [Identity: Users & Settings](../users-settings/) | `/api/v1/user`, `/api/v1/users` | always | -| 2 | [Identity: Organizations & Teams](../organizations-teams/) | `/api/v1/orgs`, `/api/v1/teams` | always | -| 3 | [Administration](../administration/) | `/api/v1/admin`, `/api/v1/accounts/admin` | always | -| 4 | [Authorization (Roles & Permissions)](../authorization/) | `/api/v1/authz` | always | -| 5 | [Cluster Management (v1 + K8s proxy + Helm)](../cluster-management-v1/) | `/api/v1/clusters` | always | -| 6 | [Cluster Management v2](../cluster-management-v2/) | `/api/v1/clustersv2` | always | -| 7 | [Multi-cluster (OCM hub/spoke)](../multicluster-ocm/) | `/api/v1/clusters/:owner/:cluster/...` | always | -| 8 | [Client Organizations](../client-organizations/) | `/api/v1/user/client*`, `/api/v1/clusters/.../permission` | always | -| 9 | [Cloud Providers](../cloud-providers/) | `/api/v1/clouds` | always | -| 10 | [Platform Installer](../ace-installer/) | `/api/v1/ace-installer` | AppsCode-hosted only | -| 11 | [Platform Upgrade](../ace-upgrade/) | `/api/v1/upgrade`, `/api/v1/clusters/.../upgrade` | always | -| 12 | [Licensing & Contracts](../licensing-contracts/) | `/api/v1/contracts`, `/api/v1/user/contracts`, `/api/v1/register`, `/api/v1/license` | contracts: AppsCode-hosted | -| 13 | [Billing Dashboard & Usage Reports](../billing-dashboard/) | `/api/v1/dashboard`, `/api/v1/user/dashboard`, `/api/v1/dbaas` | billing-enabled deployments | -| 14 | [Marketplace](../marketplace/) | `/api/v1/marketplaces` (separate service), `/api/v1/proxy/metered-billing` | marketplace deployments | -| 15 | [Monitoring & Telemetry](../monitoring-telemetry/) | `/api/v1/telemetry`, `/api/v1/trickster` | always | -| 16 | [Rancher Integration](../rancher/) | `/api/v1/rancher` | always | -| 17 | [Helm Chart Repositories (public)](../chart-repositories/) | `/api/v1/chartrepositories` | always | -| 18 | [Miscellaneous & Site Settings](../miscellaneous/) | `/api/v1/version`, `/api/v1/markdown`, `/api/v1/branding`, ... | always | - -![KubeDB Platform /api/v1 API group map](../images/api-groups.svg) - -## 5. Typical Request Flows - -### Cluster resource access via the Kubernetes proxy - -![Kubernetes proxy request flow](../images/flow-proxy.svg) - -### License issuance for a contract cluster - -![License issuance flow](../images/flow-license.svg) - -### Usage → billing pipeline - -![Usage to billing pipeline](../images/flow-billing.svg) - -## 6. Deployment Modes - -| Mode | `DEPLOYMENT_TYPE` | Notes | -|---|---|---| -| AppsCode-hosted (SaaS) | `Hosted` | Full surface incl. contracts admin, installer, Firebase tokens | -| Self-hosted | `SelfHostedProduction` (offline installs also set the separate `OfflineInstaller` flag) | Runs from a generated installer bundle; `/selfhost` console URL | -| AWS Marketplace | `AWSMarketplace` | Marketplace webhooks + AWS metering proxy enabled | -| GCP Marketplace | `GoogleCloudMarketplace` | Marketplace webhooks + GCP metering proxy enabled | -| Azure Marketplace | `AzureMarketplace` | Recognized marketplace mode (webhooks); no metering proxy wired up | - -Feature gating summary: - -- `AppsCodeHosted` → contracts admin APIs, installer APIs, org claim, Firebase token. -- `IsBillingEnabled()` → billing dashboard APIs (admin, user, usage reports). -- `DeploymentType` → which marketplace metering proxy (if any) is registered. -- License enforcement is compiled in (`ENFORCE_LICENSE=true`); the server validates its own license at startup. diff --git a/docs/platform/api/rancher/README.md b/docs/platform/api/rancher/README.md new file mode 100644 index 0000000..ae70ee5 --- /dev/null +++ b/docs/platform/api/rancher/README.md @@ -0,0 +1,48 @@ +--- +layout: docs +menu: + docsplatform_{{.version}}: + identifier: api-rancher-readme + name: Overview + parent: api-rancher + weight: -1 +menu_name: docsplatform_{{.version}} +section_menu_id: api +url: /docs/platform/{{.version}}/api/rancher/ +aliases: +- /docs/platform/{{.version}}/api/rancher/overview/ +--- + +# Rancher Integration API + +The Rancher Integration API wires the KubeDB Platform together with a Rancher management cluster. +It lets a site administrator sync Rancher users into a Rancher-managed +organization, obtain the `acerproxy` Helm installation command, download the +platform CA certificate, and mint Rancher proxy-server tokens. It also exposes an +endpoint that returns NATS credentials for the authenticated Rancher user. + +All routes live under the `/api/v1/rancher` prefix and require a valid bearer +token. + +> **Auth notes.** The `/rancher/org/{orgname}/...` routes require **site-admin** +> privileges **and** a **Rancher-managed organization** (an org whose origin is +> Rancher). On a platform whose organizations are not Rancher-managed these routes +> return `500` with `org isn't a rancher organization`. `POST /rancher/proxy-token` +> requires site-admin only. `GET /rancher/nats-cred` requires a token in the +> **Rancher-user** context (injected by the server's `injectRancherUserInfo` +> middleware). + +`/api/v1/rancher` (Token) + +| Method | Path | Auth | Description | +|--------|------|------|-------------| +| GET | `/org/:orgname/sync/users` | Site admin + Rancher-managed org | Sync Rancher users for an org | +| GET | `/org/:orgname/acerproxy` | Site admin + Rancher-managed org | ACER proxy installation command | +| GET | `/org/:orgname/ca/download` | Site admin + Rancher-managed org | Download CA certificate | +| POST | `/proxy-token` | Site admin | Create a Rancher proxy-server token | +| GET | `/nats-cred` | Token (Rancher user) | Get NATS credentials | + +## Pages + +- [Rancher Integration](../rancher.md) — user sync, acerproxy install + command, CA download, proxy-server token, and NATS credentials. diff --git a/docs/platform/api/rancher/_index.md b/docs/platform/api/rancher/_index.md index bf6f17d..81098b5 100644 --- a/docs/platform/api/rancher/_index.md +++ b/docs/platform/api/rancher/_index.md @@ -9,27 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Rancher Integration API - -The Rancher Integration API wires the KubeDB Platform together with a Rancher management cluster. -It lets a site administrator sync Rancher users into a Rancher-managed -organization, obtain the `acerproxy` Helm installation command, download the -platform CA certificate, and mint Rancher proxy-server tokens. It also exposes an -endpoint that returns NATS credentials for the authenticated Rancher user. - -All routes live under the `/api/v1/rancher` prefix and require a valid bearer -token. - -> **Auth notes.** The `/rancher/org/{orgname}/...` routes require **site-admin** -> privileges **and** a **Rancher-managed organization** (an org whose origin is -> Rancher). On a platform whose organizations are not Rancher-managed these routes -> return `500` with `org isn't a rancher organization`. `POST /rancher/proxy-token` -> requires site-admin only. `GET /rancher/nats-cred` requires a token in the -> **Rancher-user** context (injected by the server's `injectRancherUserInfo` -> middleware). - -## Pages - -- [Rancher Integration](../rancher.md) — user sync, acerproxy install - command, CA download, proxy-server token, and NATS credentials. diff --git a/docs/platform/api/rancher/overview.md b/docs/platform/api/rancher/overview.md deleted file mode 100644 index 78bf46f..0000000 --- a/docs/platform/api/rancher/overview.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -layout: docs -menu: - docsplatform_{{.version}}: - identifier: api-rancher-overview - name: Overview - parent: api-rancher - weight: 5 -menu_name: docsplatform_{{.version}} -section_menu_id: api ---- - -# Rancher Integration — Overview - -`/api/v1/rancher` (Token) - -| Method | Path | Auth | Description | -|--------|------|------|-------------| -| GET | `/org/:orgname/sync/users` | Site admin + Rancher-managed org | Sync Rancher users for an org | -| GET | `/org/:orgname/acerproxy` | Site admin + Rancher-managed org | ACER proxy installation command | -| GET | `/org/:orgname/ca/download` | Site admin + Rancher-managed org | Download CA certificate | -| POST | `/proxy-token` | Site admin | Create a Rancher proxy-server token | -| GET | `/nats-cred` | Token (Rancher user) | Get NATS credentials | - -## Reference pages - -- [Rancher](../rancher.md) diff --git a/docs/platform/api/users-settings/overview.md b/docs/platform/api/users-settings/README.md similarity index 76% rename from docs/platform/api/users-settings/overview.md rename to docs/platform/api/users-settings/README.md index cdb5857..be8b386 100644 --- a/docs/platform/api/users-settings/overview.md +++ b/docs/platform/api/users-settings/README.md @@ -2,15 +2,28 @@ layout: docs menu: docsplatform_{{.version}}: - identifier: api-users-settings-overview + identifier: api-users-settings-readme name: Overview parent: api-users-settings - weight: 5 + weight: -1 menu_name: docsplatform_{{.version}} section_menu_id: api +url: /docs/platform/{{.version}}/api/users-settings/ +aliases: +- /docs/platform/{{.version}}/api/users-settings/overview/ --- -# Identity: Users & Settings — Overview +# Identity: Users & Settings + +APIs for user accounts, profile and security settings, personal access and NATS +tokens, cloud credentials, and social (follow) relationships. These endpoints back +the account and settings screens of the KubeDB Platform web console and let you script the same +operations against the KubeDB Platform API Server. + +All routes are served under the `/api/v1` prefix. Most endpoints authenticate with a +personal access token sent as `Authorization: token ` (it may also be +supplied as a `token` or `access_token` query parameter). A handful of routes are +public (no auth) or use HTTP Basic auth — this is called out per endpoint. User accounts, profile/security settings, tokens, credentials, and deploy orders. This is the identity foundation the rest of the platform builds on: every @@ -86,8 +99,15 @@ through these endpoints authenticate the token-guarded REST API. | POST | `/applications/oauth2/:id/regenerate_secret`, `/:id/revoke` | Rotate secret / revoke grant | | GET | `/applications/oauth2/grants` | List OAuth2 grants | -## Reference pages +## Pages -- [Public user APIs](../public-user-apis.md) -- [Authenticated user](../authenticated-user.md) -- [User settings](../user-settings.md) +- [Public & Basic-auth User APIs](../public-user-apis.md) — public + user lookup/search, a user's organizations, social follow info, HTTP Basic-auth + token management, and sign-in. +- [Authenticated User](../authenticated-user.md) — the + `/api/v1/user/*` endpoints: the current user, emails, NATS credentials, cloud + credentials, clusters, teams, organizations, and name/email validation. +- [User Settings](../user-settings.md) — the + `/api/v1/user/settings/*` endpoints: profile and avatar, password and account + emails, 2FA and WebAuthn security, sessions, personal access and NATS tokens, and + OAuth2 applications. diff --git a/docs/platform/api/users-settings/_index.md b/docs/platform/api/users-settings/_index.md index 52a3d81..8c8568c 100644 --- a/docs/platform/api/users-settings/_index.md +++ b/docs/platform/api/users-settings/_index.md @@ -9,28 +9,3 @@ menu: menu_name: docsplatform_{{.version}} section_menu_id: api --- - -# Identity: Users & Settings - -APIs for user accounts, profile and security settings, personal access and NATS -tokens, cloud credentials, and social (follow) relationships. These endpoints back -the account and settings screens of the KubeDB Platform web console and let you script the same -operations against the KubeDB Platform API Server. - -All routes are served under the `/api/v1` prefix. Most endpoints authenticate with a -personal access token sent as `Authorization: token ` (it may also be -supplied as a `token` or `access_token` query parameter). A handful of routes are -public (no auth) or use HTTP Basic auth — this is called out per endpoint. - -## Pages - -- [Public & Basic-auth User APIs](../public-user-apis.md) — public - user lookup/search, a user's organizations, social follow info, HTTP Basic-auth - token management, and sign-in. -- [Authenticated User](../authenticated-user.md) — the - `/api/v1/user/*` endpoints: the current user, emails, NATS credentials, cloud - credentials, clusters, teams, organizations, and name/email validation. -- [User Settings](../user-settings.md) — the - `/api/v1/user/settings/*` endpoints: profile and avatar, password and account - emails, 2FA and WebAuthn security, sessions, personal access and NATS tokens, and - OAuth2 applications. From 714368ffc271c153199dbaeb75ce5c77b3b18278 Mon Sep 17 00:00:00 2001 From: Tamal Saha Date: Tue, 14 Jul 2026 14:41:52 +0600 Subject: [PATCH 2/2] docs(platform): show per-group API README as an "Overview" sidebar link The sidebar partial (menu/group.html) skips a group's child menu entries whose weight is -1 (that value marks a section-landing headline). The consolidated per-group README.md pages were created with weight -1, so they disappeared from the left column instead of appearing as "Overview". Give the 18 per-group READMEs a positive weight (1) so they render as the first "Overview" link under each group, matching the old overview.md behavior. The top-level README stays weight -1 (it is a direct section child rendered by menu/leaf.html, which does show it, as the section headline). Signed-off-by: Tamal Saha --- docs/platform/api/ace-installer/README.md | 2 +- docs/platform/api/ace-upgrade/README.md | 2 +- docs/platform/api/administration/README.md | 2 +- docs/platform/api/authorization/README.md | 2 +- docs/platform/api/billing-dashboard/README.md | 2 +- docs/platform/api/chart-repositories/README.md | 2 +- docs/platform/api/client-organizations/README.md | 2 +- docs/platform/api/cloud-providers/README.md | 2 +- docs/platform/api/cluster-management-v1/README.md | 2 +- docs/platform/api/cluster-management-v2/README.md | 2 +- docs/platform/api/licensing-contracts/README.md | 2 +- docs/platform/api/marketplace/README.md | 2 +- docs/platform/api/miscellaneous/README.md | 2 +- docs/platform/api/monitoring-telemetry/README.md | 2 +- docs/platform/api/multicluster-ocm/README.md | 2 +- docs/platform/api/organizations-teams/README.md | 2 +- docs/platform/api/rancher/README.md | 2 +- docs/platform/api/users-settings/README.md | 2 +- 18 files changed, 18 insertions(+), 18 deletions(-) diff --git a/docs/platform/api/ace-installer/README.md b/docs/platform/api/ace-installer/README.md index c5d64a7..03b7e96 100644 --- a/docs/platform/api/ace-installer/README.md +++ b/docs/platform/api/ace-installer/README.md @@ -5,7 +5,7 @@ menu: identifier: api-ace-installer-readme name: Overview parent: api-ace-installer - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/ace-installer/ diff --git a/docs/platform/api/ace-upgrade/README.md b/docs/platform/api/ace-upgrade/README.md index a6c111a..5837e51 100644 --- a/docs/platform/api/ace-upgrade/README.md +++ b/docs/platform/api/ace-upgrade/README.md @@ -5,7 +5,7 @@ menu: identifier: api-ace-upgrade-readme name: Overview parent: api-ace-upgrade - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/ace-upgrade/ diff --git a/docs/platform/api/administration/README.md b/docs/platform/api/administration/README.md index eaedbe6..36d201f 100644 --- a/docs/platform/api/administration/README.md +++ b/docs/platform/api/administration/README.md @@ -5,7 +5,7 @@ menu: identifier: api-administration-readme name: Overview parent: api-administration - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/administration/ diff --git a/docs/platform/api/authorization/README.md b/docs/platform/api/authorization/README.md index 7a7227c..9f7aeec 100644 --- a/docs/platform/api/authorization/README.md +++ b/docs/platform/api/authorization/README.md @@ -5,7 +5,7 @@ menu: identifier: api-authorization-readme name: Overview parent: api-authorization - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/authorization/ diff --git a/docs/platform/api/billing-dashboard/README.md b/docs/platform/api/billing-dashboard/README.md index a12f09c..52bbd8b 100644 --- a/docs/platform/api/billing-dashboard/README.md +++ b/docs/platform/api/billing-dashboard/README.md @@ -5,7 +5,7 @@ menu: identifier: api-billing-dashboard-readme name: Overview parent: api-billing-dashboard - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/billing-dashboard/ diff --git a/docs/platform/api/chart-repositories/README.md b/docs/platform/api/chart-repositories/README.md index a3e6b3f..4274632 100644 --- a/docs/platform/api/chart-repositories/README.md +++ b/docs/platform/api/chart-repositories/README.md @@ -5,7 +5,7 @@ menu: identifier: api-chart-repositories-readme name: Overview parent: api-chart-repositories - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/chart-repositories/ diff --git a/docs/platform/api/client-organizations/README.md b/docs/platform/api/client-organizations/README.md index 501220a..12e110f 100644 --- a/docs/platform/api/client-organizations/README.md +++ b/docs/platform/api/client-organizations/README.md @@ -5,7 +5,7 @@ menu: identifier: api-client-organizations-readme name: Overview parent: api-client-organizations - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/client-organizations/ diff --git a/docs/platform/api/cloud-providers/README.md b/docs/platform/api/cloud-providers/README.md index 7b50611..0ad5060 100644 --- a/docs/platform/api/cloud-providers/README.md +++ b/docs/platform/api/cloud-providers/README.md @@ -5,7 +5,7 @@ menu: identifier: api-cloud-providers-readme name: Overview parent: api-cloud-providers - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/cloud-providers/ diff --git a/docs/platform/api/cluster-management-v1/README.md b/docs/platform/api/cluster-management-v1/README.md index 56f3d46..1b431eb 100644 --- a/docs/platform/api/cluster-management-v1/README.md +++ b/docs/platform/api/cluster-management-v1/README.md @@ -5,7 +5,7 @@ menu: identifier: api-cluster-management-v1-readme name: Overview parent: api-cluster-management-v1 - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/cluster-management-v1/ diff --git a/docs/platform/api/cluster-management-v2/README.md b/docs/platform/api/cluster-management-v2/README.md index 8562618..fb9fa8f 100644 --- a/docs/platform/api/cluster-management-v2/README.md +++ b/docs/platform/api/cluster-management-v2/README.md @@ -5,7 +5,7 @@ menu: identifier: api-cluster-management-v2-readme name: Overview parent: api-cluster-management-v2 - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/cluster-management-v2/ diff --git a/docs/platform/api/licensing-contracts/README.md b/docs/platform/api/licensing-contracts/README.md index 292c631..074bc0a 100644 --- a/docs/platform/api/licensing-contracts/README.md +++ b/docs/platform/api/licensing-contracts/README.md @@ -5,7 +5,7 @@ menu: identifier: api-licensing-contracts-readme name: Overview parent: api-licensing-contracts - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/licensing-contracts/ diff --git a/docs/platform/api/marketplace/README.md b/docs/platform/api/marketplace/README.md index 5d64c14..bce0c4f 100644 --- a/docs/platform/api/marketplace/README.md +++ b/docs/platform/api/marketplace/README.md @@ -5,7 +5,7 @@ menu: identifier: api-marketplace-readme name: Overview parent: api-marketplace - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/marketplace/ diff --git a/docs/platform/api/miscellaneous/README.md b/docs/platform/api/miscellaneous/README.md index 04c55ef..03b5e5d 100644 --- a/docs/platform/api/miscellaneous/README.md +++ b/docs/platform/api/miscellaneous/README.md @@ -5,7 +5,7 @@ menu: identifier: api-miscellaneous-readme name: Overview parent: api-miscellaneous - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/miscellaneous/ diff --git a/docs/platform/api/monitoring-telemetry/README.md b/docs/platform/api/monitoring-telemetry/README.md index 1d93e29..7dbe34f 100644 --- a/docs/platform/api/monitoring-telemetry/README.md +++ b/docs/platform/api/monitoring-telemetry/README.md @@ -5,7 +5,7 @@ menu: identifier: api-monitoring-telemetry-readme name: Overview parent: api-monitoring-telemetry - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/monitoring-telemetry/ diff --git a/docs/platform/api/multicluster-ocm/README.md b/docs/platform/api/multicluster-ocm/README.md index ae8ec9e..4c85c25 100644 --- a/docs/platform/api/multicluster-ocm/README.md +++ b/docs/platform/api/multicluster-ocm/README.md @@ -5,7 +5,7 @@ menu: identifier: api-multicluster-ocm-readme name: Overview parent: api-multicluster-ocm - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/multicluster-ocm/ diff --git a/docs/platform/api/organizations-teams/README.md b/docs/platform/api/organizations-teams/README.md index 7203a9e..cf93961 100644 --- a/docs/platform/api/organizations-teams/README.md +++ b/docs/platform/api/organizations-teams/README.md @@ -5,7 +5,7 @@ menu: identifier: api-organizations-teams-readme name: Overview parent: api-organizations-teams - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/organizations-teams/ diff --git a/docs/platform/api/rancher/README.md b/docs/platform/api/rancher/README.md index ae70ee5..a19b610 100644 --- a/docs/platform/api/rancher/README.md +++ b/docs/platform/api/rancher/README.md @@ -5,7 +5,7 @@ menu: identifier: api-rancher-readme name: Overview parent: api-rancher - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/rancher/ diff --git a/docs/platform/api/users-settings/README.md b/docs/platform/api/users-settings/README.md index be8b386..fc3b38f 100644 --- a/docs/platform/api/users-settings/README.md +++ b/docs/platform/api/users-settings/README.md @@ -5,7 +5,7 @@ menu: identifier: api-users-settings-readme name: Overview parent: api-users-settings - weight: -1 + weight: 1 menu_name: docsplatform_{{.version}} section_menu_id: api url: /docs/platform/{{.version}}/api/users-settings/