Organization

Configuration for creating an organization in Service Bridge.

Organization

Organization is a root of the Service Bridge object hierarchy. Each organization is completely independent of the other with its own set of tenants, users, teams, clusters and workspaces.

Organizations in TSB are tied to an Identity Provider (IdP). Users and teams, representing the organizational structure, are periodically synchronized from the IdP into TSB in order to make them available for access policy configuration.

The following example creates an organization named myorg.

apiVersion: api.tsb.tetrate.io/v2
kind: Organization
metadata:
  name: myorg

Field	Description	Validation Rule
deletionProtectionEnabled	bool When set, prevents the resource from being deleted. In order to delete the resource this property needs to be set to false first.	–
profiles	List of string List of profiles attached to the Organization to be used to propagate default and mandatory configurations down to the children.	–
configGenerationMetadata	tetrateio.api.tsb.types.v2.ConfigGenerationMetadata Default metadata values that will be propagated to the children Istio generated configurations. When using YAML APIs like tctl or gitops, put them into the metadata.labels or metadata.annotations instead. This field is only necessary when using gRPC APIs directly.	–
systemNamespaces	List of string List of namespaces that will be considered as system namespaces for the organization and will not be able to be onboarded into TSB. System namespaces are namespaces that should not have sidecars injected and don't be configured with Istio injection. This is useful for namespaces that are used for infrastructure components like monitoring, logging, cloud provider components, etc. and that should not be managed by TSB in the cluster namespace onboarding workflows.	–
serviceAccountKeySettings	tetrateio.api.tsb.v2.Organization.ServiceAccountKeySettings Settings that govern how the key pairs of the service accounts in this organization are generated. They are only applied to the keys generated after the settings are changed; existing service account keys are left untouched. If omitted, RSA keys of 2048 bits are generated.	–

ServiceAccountKeySettings

Settings that govern how the key pairs of the service accounts in this organization are generated.

Field	Description	Validation Rule
algorithm	tetrateio.api.tsb.v2.Organization.ServiceAccountKeySettings.Algorithm Algorithm used to generate the service account key pairs.	–
rsaKeySize	uint32 Size in bits of the generated RSA keys. It only applies when algorithm is an RSA based one, and must be left unset for the ECDSA ones, where the curve is determined by the algorithm itself. Supported values are 2048, 3072 and 4096. Defaults to 2048.	uint32 = {   in: 0,2048,3072,4096 }

Algorithm

Algorithms supported to sign the tokens issued with a service account key.

Field	Number	Description
RS256	0	RSA / SHA-256.
ES256	1	ECDSA using the P-256 curve / SHA-256.
ES384	2	ECDSA using the P-384 curve / SHA-384.
ES512	3	ECDSA using the P-521 curve / SHA-512.