Team
Teams are composed of multiple users and define a way to manage cluster access or other objects for multiple users at once. You can assign users automatically to teams by their groups, which can be synced from an authentication provider. Teams can also access Loft through their own access keys and own spaces or other objects.
Example Team
An example Team:
apiVersion: management.loft.sh/v1
kind: Team
metadata:
creationTimestamp: null
name: my-team
spec:
clusterRoles:
- name: loft-management-admin
description: All users in this team have full admin access to all clusters
displayName: Global Admins
groups:
- loft:admins
username: loftadmins
status: {}
Team Reference
kind required string
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
kind required string apiVersion required string
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
apiVersion required string metadata required object
metadata required object spec required object
spec required object status required object
status required object Retrieve: Teams
You can either use curl or kubectl to retrieve Teams.
- kubectl
- curl
Retrieve a list of Teams
Run the following command to list all Teams:
kubectl get teams.management.loft.sh -o yaml
Retrieve a single Team by name
Run the following kubectl command to get Team my-team:
kubectl get teams.management.loft.sh my-team -o yaml
Retrieve a list of Teams
Run the following curl command to list all Teams:
curl -s "https://$LOFT_DOMAIN/kubernetes/management/apis/management.loft.sh/v1/teams" \
-X GET --insecure \
-H "Authorization: Bearer $ACCESS_KEY"
Get a single Team by name
Run the following curl command to get Team my-team:
# Exchange my-team in the url below with the name of the Team
curl -s "https://$LOFT_DOMAIN/kubernetes/management/apis/management.loft.sh/v1/teams/my-team" \
-X GET --insecure \
-H "Authorization: Bearer $ACCESS_KEY"
Create: Team
You can either use curl or kubectl to create a new Team.
- kubectl
- curl
Create a file object.yaml with the following contents:
apiVersion: management.loft.sh/v1
kind: Team
metadata:
creationTimestamp: null
name: my-team
spec:
clusterRoles:
- name: loft-management-admin
description: All users in this team have full admin access to all clusters
displayName: Global Admins
groups:
- loft:admins
username: loftadmins
status: {}
Then create the Team my-team with:
kubectl create -f object.yaml
Create a file object.yaml with the following contents:
apiVersion: management.loft.sh/v1
kind: Team
metadata:
creationTimestamp: null
name: my-team
spec:
clusterRoles:
- name: loft-management-admin
description: All users in this team have full admin access to all clusters
displayName: Global Admins
groups:
- loft:admins
username: loftadmins
status: {}
Run the following curl command to create a new Team my-team:
curl -s -X POST --insecure \
"https://$LOFT_DOMAIN/kuberentes/management/apis/management.loft.sh/v1/teams" \
--data-binary "$(cat object.yaml)" \
-H "Content-Type: application/yaml" \
-H "Authorization: Bearer $ACCESS_KEY"
Update: Team
You can either use curl or kubectl to update Teams.
- kubectl
- curl
Update Team
Run the following command to update Team my-team:
kubectl edit teams.management.loft.sh my-team
Then edit the object and upon save, kubectl will update the resource.
Patch Team
Patching a resource is useful if you want to generically exchange only a small portion of the object instead of retrieving the whole object first and then modifying it. To learn more about patches in Kubernetes, please take a look at the official docs.
Run the following kubectl command to add a new annotation my-annotation: my-value to the Team my-team via a patch:
kubectl patch teams.management.loft.sh my-team \
--type json \
-p '[{"op": "add", "path": "/metadata/annotations/my-annotation", "value": "my-value"}]'
Update Team
First retrieve the current object into a file object.yaml. This could look like:
apiVersion: management.loft.sh/v1
kind: Team
metadata:
creationTimestamp: "2023-04-03T00:00:00Z"
generation: 12
name: my-team
resourceVersion: "66325905"
uid: af5f9f0f-8ab9-4b4b-a595-a95a5921f3c2
spec:
clusterRoles:
- name: loft-management-admin
description: All users in this team have full admin access to all clusters
displayName: Global Admins
groups:
- loft:admins
username: loftadmins
status: {}
Run the following curl command to update a single Team my-team:
# Replace the my-team in the url below with the name of the Team you want to update
curl -s "https://$LOFT_DOMAIN/kubernetes/management/apis/management.loft.sh/v1/teams/my-team" \
-X PUT --insecure \
-H "Content-Type: application/yaml" \
-H "Authorization: Bearer $ACCESS_KEY" \
--data-binary "$(cat object.yaml)"
Patch Team
Patching a resource is useful if you want to generically exchange only a small portion of the object instead of retrieving the whole object first and then modifying it. To learn more about patches in Kubernetes, please take a look at the official docs.
Run the following curl command to add a new annotation my-annotation: my-value to the Team my-team via a patch:
# Replace the my-team in the url below with the name of the Team you want to update
curl -s "https://$LOFT_DOMAIN/kubernetes/management/apis/management.loft.sh/v1/teams/my-team" \
-X PATCH --insecure \
-H "Content-Type: application/json-patch+json" \
-H "Authorization: Bearer $ACCESS_KEY" \
--data '[{"op": "add", "path": "/metadata/annotations/my-annotation", "value": "my-value"}]'
Delete: Team
You can either use curl or kubectl to delete Teams.
- kubectl
- curl
Run the following command to delete Team my-team:
kubectl delete teams.management.loft.sh my-team
Run the following curl command to delete Team my-team:
# Replace the my-team in the url below with the name of the Team you want to delete
curl -s "https://$LOFT_DOMAIN/kubernetes/management/apis/management.loft.sh/v1/teams/my-team" \
-X DELETE --insecure \
-H "Authorization: Bearer $ACCESS_KEY"