# Kubernetes Operator

> Deploy and reconcile Thoth tenant governance in customer Kubernetes clusters with the official thoth-operator.

Source: https://docs.atensecurity.com/docs/kubernetes-operator

Use the `thoth-operator` when you want Kubernetes-native, GitOps-friendly
reconciliation of Thoth control-plane tenant configuration.

## Source repository

- GitHub: `github.com/atensecurity/thoth-operator`

## What it reconciles

- Tenant settings
- MDM provider configuration
- Pack assignments
- Policy sync triggers
- Optional governance evidence backfill jobs
- Optional decision-field backfill jobs

## Recommended deployment pattern

Choose one owner for each configuration surface and avoid competing reconciliation:

1. Use Terraform/Pulumi providers for account-level and long-lived platform resources.
2. Use `thoth-operator` for cluster-local tenant bootstrap and day-2 reconciliation.
3. Use optional backfill blocks in `ThothTenant` when you need to recover evidence completeness after rollout changes.

## Endpoint model

By default, the operator derives tenant endpoint URLs as:

`https://grid.<tenant_id>.<apex_domain>`

Set `apiBaseURL` to the supplied GovAPI endpoint when your environment uses
an explicit base URL. Confirm derived routing with your administrator before
using the fallback. The SDK runtime URL is a separate endpoint.

## Next steps

1. [Quickstart](https://docs.atensecurity.com/docs/kubernetes-operator/quickstart)
2. [CRD Reference](https://docs.atensecurity.com/docs/kubernetes-operator/crd-reference)
3. [Public runbook](https://github.com/atensecurity/thoth-runbooks/blob/main/onboarding/kubernetes-operator.md)