Organization
Organization
Represents the root of the Infrastream resource hierarchy.
Serves as the top-level container for all Organizational Units, GitHub Connections, identity providers, and global users. It establishes global configuration baselines for both GCP and GitHub platforms.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as an Organization so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant Organization. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name) are read by the engine to resolve this manifest's identity within the dependency graph. As the hierarchy root, an Organization has no parent manifest. |
| spec | Spec | Desired organization configuration. The authoritative, user-authored specification for this organization. See Spec. |
CodeOwnersEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |
Spec
User-authored organization configuration.
Defines the global, user-supplied settings for the entire organization: descriptive context, internal/external domain bindings, the default GCP region, the primary GitHub organization, the org-wide hibernation schedule, and the workforce identity-federation strategy.
| Property | Type | Description |
|---|---|---|
| description | string | Human-readable description of the organization. Optional free text describing the organization's purpose. Propagated onto the description of the core organization-manifests GitHub repository, and used as context by AI assistants when reasoning about the platform's structure. |
| domain | Domain | Internal and external domain names. Required. Sets the base DNS domains for the organization from which all descendant hostnames are derived. See Domain. |
| defaultRegion | string | Default GCP region for organization resources. Required. The fallback region for resources created within the organization; can be overridden at the OrganizationalUnit, Environment, or Project level. Sets the location of the core infrastream-docker-mirror Artifact Registry and the region of the organization's private Certificate Authority pool. |
| github | GithubConfig | Primary GitHub organization settings. Required. Configures the GitHub organization that owns the central GitOps repository hosting the hydrated organization manifests (the source of truth for core infrastructure). The GitHub organization name is used to construct the manifests repository name (e.g. <org>-infrastream-organization-manifests) and feeds the computed code-owner mappings. To connect other repositories or organizations for application source code, use the GithubConnection manifest instead. |
| hibernation | HibernationConfig | Default org-wide hibernation schedule. Baseline active-hours schedule inherited by all resources in the organization; can be overridden at lower levels. Resolved into the computed hibernation block and applied to control when resources across the platform are awake or hibernated. |
| workforceFederation | WorkforceFederation | Identity source for the organization. Required. Selects and configures the workforce identity-federation backend from which the organization's users are drawn. See WorkforceFederation. |
Domain
Internal and external DNS domains for the organization.
The two fully-qualified base domains from which per-environment and per-project hostnames are derived. internal roots private, in-cluster service names; external roots publicly resolvable names. Both must be lowercase FQDNs (at least two dot-separated labels, each 1-63 chars of [a-z0-9-] without a leading or trailing hyphen).
| Property | Type | Description |
|---|---|---|
| internal | string | Internal (private) base domain. Root domain for privately resolvable, in-cluster service names. Must be a lowercase FQDN (at least two dot-separated labels; each label 1-63 chars of [a-z0-9-] without a leading or trailing hyphen). |
| external | string | External (public) base domain. Root domain for publicly resolvable hostnames; child OrganizationalUnits, Environments, and Projects derive their external hostnames by prefixing their name onto this value. Must be a lowercase FQDN (at least two dot-separated labels; each label 1-63 chars of [a-z0-9-] without a leading or trailing hyphen). |
WorkforceFederation
Workforce identity-federation strategy.
Selects the identity source that supplies the organization's human users. Exactly one federation backend is chosen via the oneof: a Google Workspace directory, a Microsoft Entra ID tenant, or an Infrastream-managed directory.
| Property | Type | Description |
|---|---|---|
| googleWorkspace | GoogleWorkspace | Google Workspace backend. See GoogleWorkspace. |
| microsoftEntraId | MicrosoftEntraId | Microsoft Entra ID backend. See MicrosoftEntraId. |
| infrastreamManaged | InfrastreamManaged | Infrastream-managed backend. See InfrastreamManaged. |
GoogleWorkspace
Google Workspace federation backend.
Configuration for federating workforce identities from a Google Workspace directory via domain-wide delegation.
| Property | Type | Description |
|---|---|---|
| domain | string | Google Workspace primary domain. Required. The domain of the Google Workspace directory that supplies workforce identities. |
| customerId | string | Google Workspace customer ID. Required. The unique customer identifier of the Google Workspace account, used to scope directory API calls. |
| impersonatedEmail | string | Delegated admin email to impersonate. Required. The Google Workspace admin account impersonated via domain-wide delegation when reading and provisioning directory identities. |
InfrastreamManaged
Infrastream-managed workforce backend.
Selects the mode in which users bring their own Google accounts. Each OrganizationUser declares the address it already owns in spec.primaryEmail; Infrastream allowlists that address in the organization's identity platform and binds it as an IAM principal. Infrastream provisions no directory and owns no credential in this mode, so the backend carries no configuration — it is a discriminator.
MicrosoftEntraId
Microsoft Entra ID federation backend.
Configuration for federating workforce identities from a Microsoft Entra ID (formerly Azure AD) tenant.
| Property | Type | Description |
|---|---|---|
| issuerUri | string | OIDC issuer URI of the Entra ID tenant. Required. The token issuer URL for the Microsoft Entra ID tenant, used to establish the workforce identity federation trust. |
HibernationConfig
Consolidates hibernation scheduling logic.
Used by the orchestrator to aggregate windows and exclusions across OU, Environment, and Project inheritance chains into a final deployment state.
| Property | Type | Description |
|---|---|---|
| hibernate | bool | When set to 'true', forces the resource into hibernation immediately, overriding any active 'windows' or 'exclusions'. Defaults to 'false'. |
| windows | list of WindowsEntry | A map of recurring time windows during which the resource will be hibernated. The key of the map provides a unique name for each window. |
| exclusions | list of ExclusionsEntry | A map of specific, non-recurring time windows during which hibernation will be suspended, even if a 'window' is active. Use this for planned maintenance or high-traffic periods. The key of the map provides a unique name for each exclusion. |
GithubConfig
Configuration for the central GitOps repository hosted on GitHub.
This determines where the engine pushes hydrated infrastructure state and application configs, establishing the source of truth for the GitOps workflow.
| Property | Type | Description |
|---|---|---|
| organization | string | Owning GitHub organization. Name of the GitHub Organization that owns the central GitOps repository (e.g. pvotal-tech). This organization hosts the hydrated manifest repositories the engine pushes to, and its name is used to build repository owners and CODEOWNERS team references. Required. |
| administrators | list of string | Organization-level GitHub administrators. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: a list of GitHub usernames to be granted admin access on the managed GitOps repositories. |
WindowsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | HibernationWindow |
ExclusionsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | HibernationExclusion |
HibernationWindow
Defines a recurring period when an asset should be scaled down.
Scheduled cron strings used by the control plane's orchestration tools to dynamically stop virtual machines or scale Cloud Run instances to zero.
| Property | Type | Description |
|---|---|---|
| start | string | A cron expression defining when the hibernation window begins. |
| end | string | A cron expression defining when the hibernation window ends. |
HibernationExclusion
Defines a specific suspension of the hibernation schedule.
Prevents down-scaling operations during the specified timeframe, ensuring workloads remain active for special events or maintenance.
| Property | Type | Description |
|---|---|---|
| start | string | The start date and time for the exclusion window in RFC3339 format. RFC3339 |
| end | string | The end date and time for the exclusion window in RFC3339 format. RFC3339 |