Skip to content

KollectClusterScope

Cluster-scoped tenancy ceiling for platform operators (ADR-0207).

Spec

Field Role
allowedGVKs Cap on GVKs cluster targets may collect
allowedNamespaces Cap on workload namespaces
deniedNamespaces Platform blacklist — not overridable by Targets
snapshotSinkRefs Permitted KollectSnapshotSink names for export
databaseSinkRefs Permitted KollectDatabaseSink names for export
eventSinkRefs Permitted KollectEventSink names for export

The three allowlists are independent, one per sink family (ADR-0414). An empty allowlist is not a deny — it is "no restriction" for that family (ValidateClusterInventoryClusterScopeSinkRefs in internal/scope/collection.go), so a ceiling that means to constrain database export must populate databaseSinkRefs explicitly.

Static config only — no status subresource (ADR-0202).

Example

A cluster-wide ceiling that caps platform collection to Deployment/Service, blocks kube-system, and caps export on all three sink families. All three lists are populated on purpose: leaving one out would leave that family unrestricted, not denied.

apiVersion: kollect.dev/v1alpha1
kind: KollectClusterScope
metadata:
  name: platform-ceiling   # cluster-scoped — no namespace
spec:
  allowedGVKs:
    - group: apps
      version: v1
      kind: Deployment
    - group: ""
      version: v1
      kind: Service
  deniedNamespaces:
    - kube-system           # platform blacklist — targets cannot override
  snapshotSinkRefs:
    - platform-audit-git
  databaseSinkRefs:
    - platform-warehouse
  eventSinkRefs:
    - platform-events

The namespaced KollectScope sample (config/samples/kollect_v1alpha1_kollectscope_team-a.yaml) shows the same fields scoped to a single namespace.

Enforcement

The ceiling is checked twice (ADR-0207):

Stage Object Checks On violation
Admission KollectClusterTarget allowedGVKs (profile targetGVK and resourceRules), allowedNamespaces, deniedNamespaces, allowedStaticRefNamespaces Create/update rejected
Reconcile KollectClusterTarget allowedGVKs, allowedStaticRefNamespaces Informers unregistered; Degraded=True with ScopeGVKDenied or ScopeNamespaceDenied
Reconcile KollectClusterInventory snapshotSinkRefs / databaseSinkRefs / eventSinkRefs, allowedStaticRefNamespaces on sink refs Degraded=True with ScopeSinkDenied or SinkNamespaceDenied

Reconcile is the backstop for objects admitted before the ceiling existed or was tightened, and for targets created while profileRef did not yet resolve — a missing profile makes the profile targetGVK unknowable at admission time. allowedNamespaces and deniedNamespaces additionally cap status.effectiveNamespaces at collect time, so a selector that matches a denied namespace filters it out rather than degrading the target.

See also