Skip to content

AITenant

Bootstraps a MaaS tenant from an infrastructure namespace. AITenant creates or labels the derived tenant namespace, validates an existing tenant Gateway, owns tenant platform context such as Gateway and OIDC configuration, creates the temporary Tenant/default-tenant MaaS config object, and grants tenant-admin RBAC.

AITenant resources must be created in the controller-configured infrastructure namespace, which defaults to ai-tenants. The controller creates this namespace if it does not already exist. Set the controller --aitenant-namespace flag to use a different infrastructure namespace.

Creates outside the configured infrastructure namespace are rejected by the validating admission webhook before the object is persisted.

The controller automatically creates AITenant/models-as-a-service for the default tenant once per Config/default lifecycle. That AITenant targets the existing default Gateway and creates or adopts Tenant/default-tenant in the MaaS subscription namespace. For migration compatibility, the default tenant keeps legacy resource names such as maas-api, maas-api-route, and maas-api-auth-policy; non-default tenants use suffixed names. If an administrator deletes the default AITenant after bootstrap, the controller does not recreate it until the Config/default anchor is recreated.

Spec

AITenantSpec

Field Type Required Description
gateway AITenantGatewayRef No Existing Gateway to reference. If omitted, the Gateway name defaults to the AITenant name.
oidc TenantExternalOIDCConfig No OIDC settings for this tenant's AI Gateway platform context. AITenant-managed tenants do not mirror this into Tenant.spec.externalOIDC.
rbac AITenantRBACConfig No Tenant-admin subjects that receive RBAC in the tenant namespace and read access to this AITenant.

Tenant Namespace

For non-default tenants, the controller derives the tenant namespace from the AITenant name as ai-tenant-<aitenant-name>. AITenant names are limited to 41 characters so per-tenant platform resources stay within Kubernetes 63-character name limits. The default AITenant/models-as-a-service keeps the configured MaaS tenant namespace, usually models-as-a-service, for migration compatibility.

The controller does not delete the tenant namespace when an AITenant is deleted. During deletion, it removes the labels and annotations it added to that namespace. Gateway resources are never deleted or modified by AITenant reconciliation.

Namespace Discovery

AITenant labels tenant namespaces with ai-gateway.opendatahub.io/tenant=<aitenant-name> and maas.opendatahub.io/managed-by-aitenant=true. When maas-controller runs with --enable-tenant-namespace-discovery=true, MaaSAuthPolicy and MaaSSubscription resources in those namespaces are reconciled against the owning AITenant platform context (status.gatewayRef and spec.oidc), not the bridge Tenant.spec.gatewayRef or Tenant.spec.externalOIDC fields.

Ownership Semantics

AITenant owns derived platform context for AITenant-managed tenants:

  • Gateway context: spec.gateway intent and resolved status.gatewayRef
  • External OIDC context: spec.oidc
  • Tenant namespace metadata and tenant-admin RBAC

The temporary Tenant/default-tenant object in each tenant namespace owns MaaS-specific user configuration, such as API key and telemetry settings. For backward compatibility, old Tenant.spec.gatewayRef and Tenant.spec.externalOIDC values may remain on existing objects, but AITenant-managed reconciliation ignores them.

AITenantGatewayRef

Field Type Required Default Description
name string No metadata.name Name of the Gateway in the controller-configured Gateway namespace.

The Gateway namespace is controller configuration, not an AITenant spec field. The Gateway must already exist, normally after network or cluster administrator approval. The controller only reads the Gateway and reports the resolved reference in status.gatewayRef; it does not create, label, annotate, reconcile, adopt, or delete Gateway resources.

AITenantRBACConfig

Field Type Required Description
admins []AITenantRBACSubject No Subjects granted tenant-admin RBAC. Max 128 entries.

AITenantRBACSubject

Field Type Required Description
kind string Yes One of User, Group, or ServiceAccount.
name string Yes Subject name.
namespace string No Required only for ServiceAccount subjects.

Status

AITenantStatus

Field Type Description
phase string High-level lifecycle phase. One of Pending, Active, or Failed.
tenantNamespace string Reconciled tenant namespace.
gatewayRef TenantGatewayRef Resolved reference to the tenant Gateway.
conditions []Condition Latest observations.

Example

apiVersion: maas.opendatahub.io/v1alpha1
kind: AITenant
metadata:
  name: red-team
  namespace: ai-tenants
spec:
  gateway:
    name: red-team
  oidc:
    issuerUrl: "https://keycloak.example.com/realms/red-team"
    clientId: red-team-maas
  rbac:
    admins:
      - kind: Group
        name: red-team-admins