Tenant

apiVersion

platform.nanohype.dev/v1alpha1

kind

Tenant

scope

Cluster

reconciled by

eks-agent-platform

short names

tnt

Tenant is the cluster-scoped organizational owner of one or more Platforms. Provides aggregate budget / readiness / suspension views and a single point for non-technical persona dashboards to land on.

TenantSpec describes an organization (or sub-org) that owns one or more Platforms. Tenant is cluster-scoped — it doesn't represent a Kubernetes namespace; it represents an organizational boundary that crosses Platforms. The relationship to Platform is by `Platform.spec.tenant` referencing `Tenant.metadata.name`.

What kubectl get shows

Column	Type	Meaning
Persona	string	—
Platforms	integer	—
Ready	integer	—
Suspended	integer	—
Spend	string	—
Pct	integer	—

Spec

• primaryPersonastringrequireddefault "generic"

  sales-ops · support · finance · ops · founder · eng · marketing · legal · generic

  PrimaryPersona drives default values for new Platforms onboarded into this tenant. One of the standard persona names.

• aggregateMonthlyBudgetUsdstring

  AggregateMonthlyBudgetUsd is the soft cap on the SUM of all owned Platforms' BudgetPolicy.spec.monthlyUsd. Status reports whether the sum exceeds this; the operator does not enforce — each Platform's own BudgetPolicy is the enforcement layer. Modeled as a decimal- string to mirror BudgetPolicy.monthlyUsd.

• complianceobject

  Compliance is the posture expected of every Platform this Tenant owns. A Platform may declare more than its Tenant, never less: `cloudgov platform audit` reports a Platform declaring less than its Tenant as a finding. Nothing copies this value down — each Platform declares its own.

  • hipaaboolean

    HIPAA marks the Platform as handling PHI. One audited invariant: a Platform whose Tenant sets hipaa must set it too.

  • soc2boolean

    SOC2 marks the Platform as in SOC 2 audit scope. Two audited invariants: the referenced BudgetPolicy must have killSwitchEnabled, and a Platform whose Tenant sets soc2 must set it too.

• contactobject

  Contact carries human-readable owner info (Slack channel, on-call rotation, billing email) for ops to reach.

  • billingEmailstring

    BillingEmail — invoice + budget-breach notification recipient.

  • oncallRotationstring

    OncallRotation — Pagerduty schedule key or similar identifier.

  • slackChannelstring

    SlackChannel for tenant-wide notifications (e.g. "#acme-ops").

• displayNamestring

  DisplayName is the human-readable tenant name shown in dashboards and persona UX.