Organization
Organization
Represents the root of the Infrastream resource hierarchy.
Serves as the top-level container for all Organizational Units, GitHub Connections, identity providers, and global users. It establishes global configuration baselines for both GCP and GitHub platforms.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as an Organization so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant Organization. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name) are read by the engine to resolve this manifest's identity within the dependency graph. As the hierarchy root, an Organization has no parent manifest. |
| spec | Spec | Desired organization configuration. The authoritative, user-authored specification for this organization. See Spec. |
CodeOwnersEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |
HibernationScheduleCronsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |
Spec
User-authored organization configuration.
Defines the global, user-supplied settings for the entire organization: descriptive context, internal/external domain bindings, the default GCP region, the primary GitHub organization, the org-wide hibernation schedule, and the workforce identity-federation strategy.
| Property | Type | Description |
|---|---|---|
| description | string | Human-readable description of the organization. Optional free text describing the organization's purpose. Propagated onto the description of the core organization-manifests GitHub repository, and used as context by AI assistants when reasoning about the platform's structure. |
| domain | Domain | Internal and external domain names. Required. Sets the base DNS domains for the organization from which all descendant hostnames are derived. See Domain. |
| defaultRegion | string | Default GCP region for organization resources. Required. The fallback region for resources created within the organization; can be overridden at the OrganizationalUnit, Environment, or Project level. Sets the location of the core infrastream-docker-mirror Artifact Registry and the region of the organization's private Certificate Authority pool. |
| github | GithubConfig | Primary GitHub organization settings. Required. Configures the GitHub organization that owns the central GitOps repository hosting the hydrated organization manifests (the source of truth for core infrastructure). The GitHub organization name is used to construct the manifests repository name (e.g. <org>-infrastream-organization-manifests) and feeds the computed code-owner mappings. To connect other repositories or organizations for application source code, use the GithubConnection manifest instead. |
| permissions | AccessPermissions | Organization-level access permissions. Administrators and contributors that own the organization as a whole. They cascade down the manifest hierarchy — every descendant's effective code owners include these — and populate the global * default in the core organization-manifests repository's CODEOWNERS, so any file without a more specific owner requires review by the organization administrators. Optional: when unset, no organization-wide default code owner is emitted. |
| hibernation | HibernationConfig | Default org-wide hibernation schedule. Baseline active-hours schedule inherited by all resources in the organization; can be overridden at lower levels. Resolved into the computed hibernation block and applied to control when resources across the platform are awake or hibernated. |
| workforceFederation | WorkforceFederation | Identity source for the organization. Required. Selects and configures the workforce identity-federation backend from which the organization's users are drawn. See WorkforceFederation. |
Domain
Internal and external DNS domains for the organization.
The two fully-qualified base domains from which per-environment and per-project hostnames are derived. internal roots private, in-cluster service names; external roots publicly resolvable names. Both must be lowercase FQDNs (at least two dot-separated labels, each 1-63 chars of [a-z0-9-] without a leading or trailing hyphen).
| Property | Type | Description |
|---|---|---|
| internal | string | Internal (private) base domain. Root domain for privately resolvable, in-cluster service names. Must be a lowercase FQDN (at least two dot-separated labels; each label 1-63 chars of [a-z0-9-] without a leading or trailing hyphen). It is recommended to define a '*.internal' hostname. |
| external | string | External (public) base domain. Root domain for publicly resolvable hostnames; child OrganizationalUnits, Environments, and Projects derive their external hostnames by prefixing their name onto this value. Must be a lowercase FQDN (at least two dot-separated labels; each label 1-63 chars of [a-z0-9-] without a leading or trailing hyphen). |
WorkforceFederation
Workforce identity-federation strategy.
Selects the identity source that supplies the organization's human users. Exactly one federation backend is chosen via the oneof: a Google Workspace directory, a Microsoft Entra ID tenant, or an Infrastream-managed directory.
| Property | Type | Description |
|---|---|---|
| googleWorkspace | GoogleWorkspace | Google Workspace backend. See GoogleWorkspace. |
| microsoftEntraId | MicrosoftEntraId | Microsoft Entra ID backend. See MicrosoftEntraId. |
| infrastreamManaged | InfrastreamManaged | Infrastream-managed backend. See InfrastreamManaged. |
GoogleWorkspace
Google Workspace federation backend.
Configuration for federating workforce identities from a Google Workspace directory via domain-wide delegation.
| Property | Type | Description |
|---|---|---|
| domain | string | Google Workspace primary domain. Required. The domain of the Google Workspace directory that supplies workforce identities. |
| customerId | string | Google Workspace customer ID. Required. The unique customer identifier of the Google Workspace account, used to scope directory API calls. |
| impersonatedEmail | string | Delegated admin email to impersonate. Required. The Google Workspace admin account impersonated via domain-wide delegation when reading and provisioning directory identities. |
InfrastreamManaged
Infrastream-managed workforce backend.
Selects the mode in which users bring their own Google accounts. Each OrganizationUser declares the address it already owns in spec.primaryEmail; Infrastream allowlists that address in the organization's identity platform and binds it as an IAM principal. Infrastream provisions no directory and owns no credential in this mode, so the backend carries no configuration — it is a discriminator.
MicrosoftEntraId
Microsoft Entra ID federation backend.
Configuration for federating workforce identities from a Microsoft Entra ID (formerly Azure AD) tenant.
| Property | Type | Description |
|---|---|---|
| issuerUri | string | OIDC issuer URI of the Entra ID tenant. Required. The token issuer URL for the Microsoft Entra ID tenant, used to establish the workforce identity federation trust. |
GithubConfig
Configuration for the central GitOps repository hosted on GitHub.
This determines where the engine pushes hydrated infrastructure state and application configs, establishing the source of truth for the GitOps workflow.
| Property | Type | Description |
|---|---|---|
| organization | string | Owning GitHub organization. Name of the GitHub Organization that owns the central GitOps repository (e.g. pvotal-tech). This organization hosts the hydrated manifest repositories the engine pushes to, and its name is used to build repository owners and CODEOWNERS team references. Required. |
| administrators | list of string | Organization-level GitHub administrators. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: a list of GitHub usernames to be granted admin access on the managed GitOps repositories. |
AccessPermissions
Core definition for assigning administrative and viewer privileges across the platform.
Used by the engine to compute the final IAM policies (google_folder_iam_binding, etc.), aggregating individual user and group definitions to role assignments.
| Property | Type | Description |
|---|---|---|
| administrators | DetailedAccessPermissions | Administrators. Users and groups granted administrative privileges on the asset. Exact rights are resource-dependent but typically confer full control. See DetailedAccessPermissions. |
| contributors | DetailedAccessPermissions | Contributors. Users and groups granted contributor privileges on the asset. Exact rights are resource-dependent but typically confer read and write access. See DetailedAccessPermissions. |
| viewers | DetailedAccessPermissions | Viewers. Users and groups granted viewer privileges on the asset. Exact rights are resource-dependent but typically confer read-only access. See DetailedAccessPermissions. |
HibernationConfig
Consolidates hibernation scheduling logic.
Used by the orchestrator to aggregate windows and exclusions across OU, Environment, and Project inheritance chains into a final deployment state.
| Property | Type | Description |
|---|---|---|
| hibernate | bool | When set to 'true', forces the resource into hibernation immediately, overriding any active 'windows' or 'exclusions'. Defaults to 'false'. |
| windows | list of WindowsEntry | A map of recurring time windows during which the resource will be hibernated. The key of the map provides a unique name for each window. |
| exclusions | list of ExclusionsEntry | A map of specific, non-recurring time windows during which hibernation will be suspended, even if a 'window' is active. Use this for planned maintenance or high-traffic periods. The key of the map provides a unique name for each exclusion. |
ExclusionsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | HibernationExclusion |
DetailedAccessPermissions
Aggregation of specific user and group access definitions.
Refers to lists of OrganizationUser and OrganizationUserGroup manifests that will be parsed to retrieve actual Google Workspace identity emails for IAM binding construction.
| Property | Type | Description |
|---|---|---|
| members | list of string | A list of 'OrganizationUser' manifest names to be included in this permission set. |
| groups | list of string | A list of 'OrganizationUserGroup' manifest names to be included in this permission set. |
WindowsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | HibernationWindow |
HibernationExclusion
Defines a specific suspension of the hibernation schedule.
Prevents down-scaling operations during the specified timeframe, ensuring workloads remain active for special events or maintenance.
| Property | Type | Description |
|---|---|---|
| start | string | The start date and time for the exclusion window in RFC3339 format. RFC3339 |
| end | string | The end date and time for the exclusion window in RFC3339 format. RFC3339 |
HibernationWindow
Defines a recurring period when an asset should be scaled down.
Scheduled cron strings used by the control plane's orchestration tools to dynamically stop virtual machines or scale Cloud Run instances to zero.
| Property | Type | Description |
|---|---|---|
| start | string | A cron expression defining when the hibernation window begins. |
| end | string | A cron expression defining when the hibernation window ends. |